EUVD-2026-46419
GHSA-rj5p-xwjf-qw97
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network access with no interaction required; only low confidentiality impact scoped to the vulnerable system with no integrity or availability consequence.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any private project by supplying a project ID to the filters_data API endpoints on UserStory, Task, Issue, and Epic viewsets. Attackers can send unauthenticated GET requests to the filters_data endpoints with sequential integer project IDs to enumerate private project membership details including user IDs, full names, and gravatar hashes, bypassing the access controls that correctly restrict other project API endpoints.
AnalysisAI
Unauthenticated information disclosure in Taiga 6.10.1 exposes the full member roster and internal workflow configuration of private projects to any network-reachable attacker. The filters_data endpoints on four viewsets - UserStory, Task, Issue, and Epic - fail to enforce the authorization controls correctly applied elsewhere in the project API, allowing unauthenticated GET requests parameterized with sequential integer project IDs to return user IDs, full names, and gravatar hashes of private project members. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the trivially automatable enumeration path elevates practical risk for externally accessible deployments.
Technical ContextAI
Taiga is an open-source agile project management platform; taiga-back is its Django REST Framework-based backend, identified by CPE cpe:2.3:a:taiga:taiga-back:*:*:*:*:*:*:*:*. The root cause is CWE-862 (Missing Authorization): the filters_data action exposed on the UserStory, Task, Issue, and Epic viewsets does not perform the same permission gate applied to other project API endpoints. Because project IDs are sequential integers, an attacker can trivially enumerate valid IDs without prior knowledge of target projects. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) is consistent with this - a network-reachable, unauthenticated, low-complexity read against a production endpoint that leaks PII scoped to the vulnerable system only.
RemediationAI
Apply the vendor-released patch from the taiga-back repository at https://github.com/taigaio/taiga-back; a specific fixed release version tag is not independently confirmed from the available references - administrators should verify the latest tagged release on the repository before upgrading. As a compensating control pending patching, restrict unauthenticated access to the filters_data endpoints (/api/v1/userstories/filters_data, /api/v1/tasks/filters_data, /api/v1/issues/filters_data, /api/v1/epics/filters_data) at the reverse proxy or WAF layer; note that blocking these at the network edge may degrade the filtering UI for authenticated users until authentication checks are enforced at the application layer. For deployments that do not require public internet exposure, restricting the Taiga instance to internal networks or VPN eliminates the remote attack surface entirely. See https://www.vulncheck.com/advisories/taiga-taiga-back-private-project-member-roster-disclosure-via-unauthenticated-filters-data-endpoints for the VulnCheck advisory.
More in Taiga Back
View allSame weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today