CVE-2026-31874

Katalog CVE

CVSS 9.8 · Critical EPSS 0,70%

Kerentanan Improper Access Control pada taskosaur. Skor CVSS 3.1 9.8 (Critical) menurut github.com.

Deskripsi (NVD)

Taskosaur is an open source project management platform with conversational AI for task execution in-app. In 1.0.0, the application does not properly validate or restrict the role parameter during the user registration process. An attacker can manually modify the request payload and assign themselves elevated privileges. Because the backend does not enforce role assignment restrictions or ignore client-supplied role parameters, the server accepts the manipulated value and creates the account with SUPER_ADMIN privileges. This allows any unauthenticated attacker to register a fully privileged administrative account.

Rincian

Terbit di NVD

11 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,70% peluang dieksploitasi; lebih tinggi dari 52,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Taskosaur/Taskosaur/security/advisories/GHSA-r6gj-4663-p5mr exploit · advisory vendor
• https://github.com/Taskosaur/Taskosaur/commit/159a5a8f43761561100a57d34309830550028932 patch