traQ CVE-2026-63198

Requires that (1) the attacker controls an OAuth2 client registered on the traQ instance capable of receiving authorization codes; (2) the targeted user has already consented to a strict subset of that client's registered scopes; (3) the client has additional registered scopes beyond what the user consented to; and (4) the attacker submits an authorization request with prompt=none and an empty or omitted scope parameter against the victim's active authenticated traQ session. Limiting factors: if the user has never consented to the client at all, traQ returns consent_required and the attack fails; only traQ versions prior to 3.28.3 are affected; and exploitation yields only scopes already registered for that specific client, not arbitrary scopes.

Severity is rated CVSS 7.3 (High) with vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N, indicating a network-reachable authorization flaw that requires some privilege (PR:L) and user involvement (UI:R). The vuln.today decision label is this_week, not act_now or emergency. No EPSS score is provided, this CVE is NOT in CISA KEV, and no public PoC or exploit reference is supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. These signals are mutually consistent: a real but non-urgent authorization defect rather than a mass-exploited issue. Practical risk is bounded by strong preconditions (the attacker must already control a registered OAuth client, and the victim must have previously consented to a subset of that client's scopes), which points to targeted abuse rather than widespread opportunistic exploitation. Missing data to note explicitly: no EPSS and no KEV status to corroborate exploitation likelihood, and no independent exploit verification, so the assessment rests on the GitHub advisory, commit diff, and release notes.

An attacker who already operates a registered OAuth2 client on a traQ instance targets a user who previously authorized only a subset of that client's scopes (for example, read only). The attacker's client drives the victim's authenticated browser session to a prompt=none authorization request with the scope parameter empty or omitted; because the prior-consent check was evaluated against the empty requested set rather than the scopes actually issued, traQ returns an authorization code yielding an access token carrying all scopes registered for the client (for example, read and write). No public exploit code was identified at time of analysis.