project-management CVE-2026-10284

Q: What is the CVSS score of CVE-2026-10284?

CVE-2026-10284 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33752 MEDIUM

Improper Authorization (CWE-285)

2026-06-01 VulDB

GHSA-2q6w-qc38-vc8q

PHP Authentication Bypass

5.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 01, 2026 - 21:22 NVD

5.4 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Jun 01, 2026 - 20:54 vuln.today

DescriptionCVE.org

A flaw has been found in DevaslanPHP project-management up to 2.0.0-beta1. Affected by this vulnerability is the function editComment/doDeleteComment of the file app/Filament/Resources/TicketResource/Pages/ViewTicket.php of the component Livewire Handler. Executing a manipulation can lead to improper authorization. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Improper authorization in DevaslanPHP project-management up to 2.0.0-beta1 allows authenticated remote attackers to edit or delete ticket comments they do not own by exploiting missing ownership validation in the Livewire Handler component. The CVSS vector (PR:L, AV:N, AC:L) confirms the attack is network-accessible and requires only a low-privilege account with no user interaction. No vendor patch exists - the maintainer has not responded to the responsible disclosure submitted via GitHub issue - and no public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The affected application is a PHP-based project management tool built on the Laravel framework, using Filament as the admin panel and Livewire for reactive, server-side UI components. The vulnerability resides in app/Filament/Resources/TicketResource/Pages/ViewTicket.php within the editComment and doDeleteComment Livewire event handler methods. CWE-285 (Improper Authorization) indicates the root cause: the handler processes comment modification and deletion requests without verifying that the authenticated requester is the owner of the targeted comment. In Livewire, event handlers are server-side PHP methods invoked via WebSocket-like requests from the browser; authorization logic must be explicitly coded into each handler, and its omission creates a horizontal privilege escalation condition where any authenticated user can manipulate any other user's comments by supplying an arbitrary comment identifier. CPE string cpe:2.3:a:devaslanphp:project-management:*:*:*:*:*:*:*:* confirms all versions up to the current beta are in scope.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor has not responded to the responsible disclosure. Organizations should monitor the GitHub repository at https://github.com/devaslanphp/project-management/ and the VulDB entry at https://vuldb.com/cve/CVE-2026-10284 for any upstream fix. As an immediate compensating control, organizations with access to the source code should add authorization ownership checks directly in the editComment and doDeleteComment methods - verifying that the authenticated user's ID matches the comment author ID before executing any modification or deletion; this is the most targeted mitigation with no functional side effects for legitimate users. If code modification is not feasible, restricting application access to a minimal set of fully trusted authenticated users reduces the attack surface, though it does not eliminate the flaw. As a last resort, disabling the ticket comment feature entirely removes the vulnerable code paths but impairs core functionality. Upgrading away from the beta release track should be prioritized once a stable patched version is available.