EUVD-2026-33752
GHSA-2q6w-qc38-vc8q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in DevaslanPHP project-management up to 2.0.0-beta1. Affected by this vulnerability is the function editComment/doDeleteComment of the file app/Filament/Resources/TicketResource/Pages/ViewTicket.php of the component Livewire Handler. Executing a manipulation can lead to improper authorization. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Improper authorization in DevaslanPHP project-management up to 2.0.0-beta1 allows authenticated remote attackers to edit or delete ticket comments they do not own by exploiting missing ownership validation in the Livewire Handler component. The CVSS vector (PR:L, AV:N, AC:L) confirms the attack is network-accessible and requires only a low-privilege account with no user interaction. No vendor patch exists - the maintainer has not responded to the responsible disclosure submitted via GitHub issue - and no public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
The affected application is a PHP-based project management tool built on the Laravel framework, using Filament as the admin panel and Livewire for reactive, server-side UI components. The vulnerability resides in app/Filament/Resources/TicketResource/Pages/ViewTicket.php within the editComment and doDeleteComment Livewire event handler methods. CWE-285 (Improper Authorization) indicates the root cause: the handler processes comment modification and deletion requests without verifying that the authenticated requester is the owner of the targeted comment. In Livewire, event handlers are server-side PHP methods invoked via WebSocket-like requests from the browser; authorization logic must be explicitly coded into each handler, and its omission creates a horizontal privilege escalation condition where any authenticated user can manipulate any other user's comments by supplying an arbitrary comment identifier. CPE string cpe:2.3:a:devaslanphp:project-management:*:*:*:*:*:*:*:* confirms all versions up to the current beta are in scope.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor has not responded to the responsible disclosure. Organizations should monitor the GitHub repository at https://github.com/devaslanphp/project-management/ and the VulDB entry at https://vuldb.com/cve/CVE-2026-10284 for any upstream fix. As an immediate compensating control, organizations with access to the source code should add authorization ownership checks directly in the editComment and doDeleteComment methods - verifying that the authenticated user's ID matches the comment author ID before executing any modification or deletion; this is the most targeted mitigation with no functional side effects for legitimate users. If code modification is not feasible, restricting application access to a minimal set of fully trusted authenticated users reduces the attack surface, though it does not eliminate the flaw. As a last resort, disabling the ticket comment feature entirely removes the vulnerable code paths but impairs core functionality. Upgrading away from the beta release track should be prioritized once a stable patched version is available.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today