EUVD-2026-114081
GHSA-7v69-v46g-xrmg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
ExploitEnumerate sequential project_pk IDs
-
ExecutionCall task_center run-now/modify/delete endpoints
-
ImpactTamper scheduled tasks and read execution logs
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated account on a WHartTest instance running 2.2.0 through 2.8.1 (PR:L) and that the instance hosts more than one project. The attacker sets the project_pk parameter on the task_center ScheduledTaskViewSet/TaskExecutionViewSet endpoints to another project's sequential integer ID; because IDs are sequential, foreign project IDs are trivially guessable. No special configuration, no user interaction, and no elevated role are needed - the missing authorization check is in the default endpoint behavior. Limiting factors: the attacker must first hold any authenticated account on the same instance, and impact is confined to task read/modify/delete/trigger and execution-log disclosure within that application. |
| Impact | Signals point to a genuine but moderate-priority issue. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L, 5.3) describes a network-reachable flaw requiring low privileges (PR:L), i.e. any authenticated account, with low impact to confidentiality, integrity, and availability - consistent with a cross-project IDOR rather than full compromise. The vuln.today decision label is 'this_month' (not act_now/emergency), and the flaw was reported by VulnCheck. There is no CISA KEV listing and no EPSS score in the input, so widespread or confirmed active exploitation cannot be asserted. A public technical write-up (hackmd) documents the IDOR, which lowers the effort to reproduce, and because project_pk is a sequential integer the attack is trivially automatable against foreign projects - but the per-record impact is low (L/L/L) and the product footprint is small. Net: a real, enumeration-driven authorization bug worth patching within the month, not a high-CVSS-but-illusory issue, yet also not an emergency given the low impact metrics, the authentication requirement, and the absence of KEV/EPSS escalation signals. |
| Exploit ScenarioDerived | An authenticated low-privilege user of a multi-project WHartTest deployment (2.2.0-2.8.1) changes the project_pk parameter to another project's sequential ID and calls the task_center ScheduledTaskViewSet/TaskExecutionViewSet endpoints, letting them read execution logs and modify, delete, or trigger (run-now) scheduled tasks belonging to projects they should not access. Because project IDs are sequential integers, enumerating other projects is trivial and the attack is scriptable. A public PoC reference exists (a hackmd write-up describing the IDOR); it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Missing authorization in WHartTest 2.2.0 through 2.8.1 allows any authenticated user to reach scheduled tasks and execution logs belonging to other projects by supplying a foreign project's sequential numeric ID in the project_pk parameter, enabling modification, deletion, run-now triggering and log disclosure across project boundaries. The flaw sits in the default behavior of the task_center ScheduledTaskViewSet and TaskExecutionViewSet endpoints, so no elevated role, special configuration or user interaction is required beyond holding any valid account on an instance that hosts more than one project. It is not listed in CISA KEV and no confirmed public exploit code was identified at time of analysis; a public technical writeup of the issue exists, and the vendor issue tracker is referenced for status.
RemediationAI
No fixed version is identified in the available data - the published advisory covers 2.2.0 through 2.8.1 and the referenced vulnerable source is the v2.8.1 tree, so patch status must be confirmed against https://github.com/MGdaasLab/WHartTest/issues/166 and the vendor advisory at https://www.vulncheck.com/advisories/wharttest-2.2.0-through-2.8.1-missing-authorization-via-task-center-scheduled-task-apis before relying on any release. Because exploitation requires an authenticated account on an instance that hosts more than one project, the effective interim control is to keep deployments single-project, which removes the cross-project boundary the flaw crosses but sacrifices multi-project separation. Where multi-project operation is mandatory, restrict account provisioning on the instance to users who are trusted for every project it hosts, and monitor task_center task and execution-log access for project_pk values outside the caller's own project, accepting that this is detection rather than prevention. A public technical writeup of the issue is available at https://hackmd.io/@hieuPenguinnn/wharttest-scheduled-task-cross-project-missing-authz-idor; it is a public reference and has not been verified as working exploit code.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WHartTest is a Django-based test management platform, and the affected code lives in WHartTest_Django/task_center/views.py (ScheduledTaskViewSet at lines 19-104 and TaskExecutionViewSet at lines 107-133 of the v2.8.1 tree). Both viewsets derive the working scope from a project_pk value supplied in the request path/parameters and then act on task objects filtered by that key without verifying that the requesting user is a member of, or otherwise authorized for, the referenced project. This is CWE-862 (Missing Authorization): an object-level access control check is absent rather than misconfigured, so the endpoints behave identically for a legitimate project member and for an authenticated outsider. Because project primary keys are sequential integers, an attacker does not need to enumerate or discover identifiers - neighboring integers map predictably to other tenants' projects on the same instance. The resulting primitive covers the full task lifecycle exposed by those viewsets: reading task definitions and execution logs, modifying or deleting scheduled tasks, and invoking the run-now action. Severity is moderate: CVSS v4.0 scores it 5.3 and the independent assessment maps it to CVSS v3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, reflecting that the attacker must already hold an authenticated account and that impact is confined to task and log data within the application rather than to host or infrastructure compromise.
Know when Wharttest gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Any authenticated user (PR:L) can remotely abuse a missing authz check over sequential IDs (AV:N/AC:L/UI:N); reading logs plus modify/delete/trigger gives low C/I/A within one security authority (S:U).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet that allows authenticated users to access other projects' tasks. Attackers can set project_pk to another project's sequential ID to modify, delete, or trigger scheduled tasks via run-now and read execution logs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB