Is there a public PoC exploit available for EUVD-2026-41428?

Yes, a public proof-of-concept exploit is available for EUVD-2026-41428. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for EUVD-2026-41428?

Yes, a patch is available for EUVD-2026-41428. Update the affected software to the latest version immediately.

Taiga Back EUVD-2026-41428

Q: What is the CVSS score of EUVD-2026-41428?

EUVD-2026-41428 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-59097 MEDIUM

Missing Authorization (CWE-862)

2026-07-02 VulnCheck

GHSA-9rxg-cv94-jvcq

Authentication Bypass Taiga Back

6.9

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

PR:N confirmed by AllowAny bypass; scope unchanged and impact limited to low integrity write on due-date records only.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 20:38 vuln.today

CVSS changed

Jul 02, 2026 - 20:22 NVD

5.3 (MEDIUM) 6.9 (MEDIUM)

DescriptionCVE.org

Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project by exploiting unprotected POST endpoints on the user-story, task, and issue due-date API viewsets. Attackers can supply an arbitrary project identifier to these endpoints, which bypass permission checks and apply the AllowAny default, to pre-empt project administrators from initializing due dates by creating records before they can do so themselves.

AnalysisAI

Unauthenticated remote attackers can create default due-date records in any Taiga project by exploiting missing authorization on POST endpoints across the user-story, task, and issue due-date API viewsets in taiga-back before 6.10.2. The endpoints default to the AllowAny permission class (CWE-862), entirely bypassing project-level access controls and accepting arbitrary project identifiers in request bodies. No active exploitation is confirmed in CISA KEV, but a publicly available exploit exists, and the attack requires zero authentication, making exploitation trivially automatable against any network-exposed Taiga instance.

Technical ContextAI

Taiga is an open-source agile project management platform; taiga-back is its Django REST Framework-based API backend (CPE: cpe:2.3:a:taiga:taiga-back:*:*:*:*:*:*:*:*). The vulnerability is classified as CWE-862 (Missing Authorization): three API viewsets - for user-story, task, and issue due-date records - expose POST endpoints that apply Django REST Framework's AllowAny permission class by default rather than enforcing project membership or authentication. Because no ownership or role verification is performed on the supplied project identifier, any caller can create records within any project's due-date collection. The fix (commit f925af424623350e04d4abc45bf1dc70e70c48a9, released in 6.10.2) adds proper permission enforcement to these viewsets.

RemediationAI

Upgrade taiga-back to version 6.10.2, which resolves the missing authorization by enforcing project-level permission checks on the affected due-date POST endpoints; the authoritative patch is documented at https://github.com/taigaio/taiga-back/commit/f925af424623350e04d4abc45bf1dc70e70c48a9 and the release is available at https://github.com/taigaio/taiga-back/releases/tag/6.10.2. If an immediate upgrade is not feasible, place a reverse proxy or WAF rule in front of the Taiga API to block unauthenticated POST requests to the due-date viewset paths (typically under /api/v1/ for due-date resources), accepting the trade-off that legitimate unauthenticated API flows - if any exist - will also be blocked. Restricting Taiga API exposure to internal networks or VPN-only access eliminates the network-accessible attack surface entirely and is the most effective compensating control until patching is complete.