Phproject CVE-2026-104991

Exploitation requires (1) the Phproject instance to have the 'Restrict issue access' (security.restrict_access) confidentiality control enabled - on instances without this control there are no restricted issues to leak - and (2) the attacker to possess a valid, active API key for any account on that instance. The affected endpoints are the REST API issue routes single_get (GET /issues/{id}.json), single_comments (GET /issues/{id}/comments.json), and single_comments_post (POST /issues/{id}/comments.json), which never call allowAccess(). Limiting factors: this is not remote-unauthenticated - PR:L means a valid API key is mandatory; impact is bounded to reading restricted issue data (including owner/author emails) and posting comments, with no broader write or availability impact; affected versions are 1.1.6 through 1.8.6, fixed in 1.8.7.

This is a genuine but moderate-priority issue, not an inflated high-CVSS finding. The vendor-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N, 7.1) is internally consistent with the description: exploitation is network-reachable, low-complexity, and requires low privileges - specifically a valid API key (PR:L), which is a real authentication barrier that meaningfully limits the attacker population to existing account/key holders. The dominant impact is confidentiality (VC:H: disclosure of restricted issue contents and owner/author email addresses), with only low integrity impact (VI:L: posting unauthorized comments) and no availability impact. No EPSS score, CISA KEV listing, or public POC was provided in the input; per precision rules this is 'no public exploit identified at time of analysis.' The absence of KEV/EPSS data combined with PR:L and a niche product suggests low likelihood of widespread opportunistic exploitation. The one SSVC-relevant note: technical impact is partial (data read + limited write), it is not automatable at scale given the per-key, per-instance nature, and exploitation status is non-evidenced. There are no conflicting signals - the CVSS vector matches the description well; the main limitation is simply that exploitation-probability telemetry (EPSS/KEV/POC) is entirely absent, so risk is inferred from the vector and advisory alone.

An authenticated user of a Phproject instance that has 'Restrict issue access' (security.restrict_access) enabled uses their own valid API key to call GET /issues/{id}.json or /issues/{id}/comments.json for issues they are not authorized to see, reading confidential issue bodies and owner/author email addresses. The same key can POST to /issues/{id}/comments.json to inject comments into restricted issues. No public exploit code is identified, but the attack requires only trivial, well-documented REST calls with a valid key.