REBUILD CVE-2026-111667

Requires a valid authenticated account on the REBUILD instance at any privilege level (PR:L) - the attacker need NOT be a member of the targeted private project. The attacker must also know or enumerate the numeric task id of a task within a private project to pass to the /project/comments/list endpoint. No user interaction, no elevated/admin privileges, and no non-default configuration are needed - the missing membership check in TaskCommentController.commentList is present in the standard code path through version 4.5.0. Limiting factors: exploitation is gated by needing authenticated access and by discovery of valid task IDs, and impact is confined to reading comment text and attachment references (confidentiality only, no modification or deletion).

This is a medium-severity authorization flaw (CVSS 4.0 base 5.3) best characterized as a confidentiality-only IDOR (CWE-639). The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) is internally consistent with the description: network-reachable, low attack complexity, but requiring an authenticated low-privileged account (PR:L) and yielding only limited confidentiality impact (VC:L) with no integrity or availability effect. No EPSS score was provided in the input, and the CVE is NOT listed in CISA KEV, so there is no confirmed active exploitation. No formal proof-of-concept exploit code is cited; however, a third-party technical writeup (hackmd.io) and a direct link to the vulnerable source line (TaskCommentController.java L37-L62) are referenced, which substantially lowers the barrier to developing an exploit. Overall this is a genuine but moderate-priority issue: the authentication requirement and confidentiality-only impact keep real-world risk below that of an unauthenticated RCE, but the triviality of exploitation for any logged-in user makes it meaningful for multi-tenant REBUILD deployments where private project data must stay segregated. No signals conflict; the main gap is the absence of EPSS/KEV data to gauge exploitation likelihood in the wild.

A low-privileged but authenticated user of a REBUILD instance who is not a member of a given private project sends a request to the /project/comments/list endpoint supplying the numeric id of a task belonging to that project. Because TaskCommentController.commentList omits a project-membership check, the server returns the task's comment content and attachment references, leaking confidential project discussion. No special exploit tooling is required; a public technical writeup detailing the flaw exists, lowering the effort to reproduce.