DevaslanPHP project-management CVE-2026-10285

Q: What is the CVSS score of CVE-2026-10285?

CVE-2026-10285 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33754 MEDIUM

Improper Authorization (CWE-285)

2026-06-01 VulDB

GHSA-9xj7-hrc2-w62q

PHP Authentication Bypass

5.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 01, 2026 - 21:22 NVD

5.4 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Jun 01, 2026 - 20:54 vuln.today

DescriptionCVE.org

A vulnerability has been found in DevaslanPHP project-management up to 2.0.0-beta1. Affected by this issue is the function KanbanScrumHelper::recordUpdated of the file app/Helpers/KanbanScrumHelper.php of the component Ticket Handler. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Improper authorization in DevaslanPHP project-management (all versions through 2.0.0-beta1) allows any low-privileged authenticated attacker to remotely invoke the KanbanScrumHelper::recordUpdated function in the Ticket Handler component without adequate permission checks, resulting in unauthorized modification of ticket and kanban board records (integrity impact) and limited disruption of availability. The vendor was notified via GitHub issue #141 but had not responded at time of disclosure, meaning no patch is available. No public exploit code has been identified and the CVE does not appear in CISA KEV.

Technical ContextAI

The vulnerability resides in a PHP-based self-hosted project-management application published by DevaslanPHP, identified by CPE cpe:2.3:a:devaslanphp:project-management:*:*:*:*:*:*:*:*. The root cause is CWE-285 (Improper Authorization): the function KanbanScrumHelper::recordUpdated in app/Helpers/KanbanScrumHelper.php does not enforce sufficient authorization controls before processing ticket record updates, meaning the application confirms a user is authenticated but fails to verify whether that user has the right to act on the targeted resource. The Kanban/Scrum helper is a backend controller-layer component that arbitrates ticket state changes across project boards. The CVSS temporal metric RC:R (Report Confidence: Reasonable) indicates the flaw is credibly documented by VulDB but has not been independently confirmed by the vendor.

RemediationAI

No vendor-released patch has been identified at time of analysis - the project maintainer had not responded to the GitHub issue disclosure (#141) as of the report date. Administrators should monitor https://github.com/devaslanphp/project-management/issues/141 and the project repository at https://github.com/devaslanphp/project-management/ for any forthcoming fix. As a compensating control, restrict application access to the minimum necessary set of trusted authenticated users, reducing the pool of accounts capable of triggering the flaw - note this does not eliminate the authorization bypass but raises the bar for exploitation. Organizations with web application firewall capabilities can attempt to block or rate-limit POST/PUT requests targeting the kanban ticket update endpoints, though this will also impair legitimate functionality and requires tuning to avoid service disruption. If the codebase is accessible, a direct code-level mitigation is to add explicit ownership and role-based authorization checks in KanbanScrumHelper::recordUpdated before processing any record update, verifying that the authenticated user's ID matches the ticket owner or that the user holds the appropriate project role. Organizations running this software in multi-tenant or externally accessible deployments should treat this as higher priority given the potential for cross-user data tampering.