Taiga Back
Monthly
Unauthenticated information disclosure in Taiga 6.10.1 exposes the full member roster and internal workflow configuration of private projects to any network-reachable attacker. The filters_data endpoints on four viewsets - UserStory, Task, Issue, and Epic - fail to enforce the authorization controls correctly applied elsewhere in the project API, allowing unauthenticated GET requests parameterized with sequential integer project IDs to return user IDs, full names, and gravatar hashes of private project members. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the trivially automatable enumeration path elevates practical risk for externally accessible deployments.
Unauthenticated remote attackers can create default due-date records in any Taiga project by exploiting missing authorization on POST endpoints across the user-story, task, and issue due-date API viewsets in taiga-back before 6.10.2. The endpoints default to the AllowAny permission class (CWE-862), entirely bypassing project-level access controls and accepting arbitrary project identifiers in request bodies. No active exploitation is confirmed in CISA KEV, but a publicly available exploit exists, and the attack requires zero authentication, making exploitation trivially automatable against any network-exposed Taiga instance.
Unauthenticated information disclosure in Taiga 6.10.1 exposes the full member roster and internal workflow configuration of private projects to any network-reachable attacker. The filters_data endpoints on four viewsets - UserStory, Task, Issue, and Epic - fail to enforce the authorization controls correctly applied elsewhere in the project API, allowing unauthenticated GET requests parameterized with sequential integer project IDs to return user IDs, full names, and gravatar hashes of private project members. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the trivially automatable enumeration path elevates practical risk for externally accessible deployments.
Unauthenticated remote attackers can create default due-date records in any Taiga project by exploiting missing authorization on POST endpoints across the user-story, task, and issue due-date API viewsets in taiga-back before 6.10.2. The endpoints default to the AllowAny permission class (CWE-862), entirely bypassing project-level access controls and accepting arbitrary project identifiers in request bodies. No active exploitation is confirmed in CISA KEV, but a publicly available exploit exists, and the attack requires zero authentication, making exploitation trivially automatable against any network-exposed Taiga instance.