CVE-2026-11439
MEDIUMtheonedev Parent Project projects improper authorization
Title source: cnaDescription
A vulnerability was found in theonedev onedev up to 15.0.5. Affected by this issue is some unknown functionality of the file /projects/ of the component Parent Project Handler. The manipulation of the argument project.parentId results in improper authorization. The attack may be performed from remote. Upgrading to version 15.0.6 can resolve this issue. It is recommended to upgrade the affected component.
References (6)
Core 6
Core References
Vdb Entry, Technical Description vdb-entry
technical-description
VDB-369019 | theonedev Parent Project projects improper authorization
https://vuldb.com/vuln/369019
Signature, Permissions Required signature
permissions-required
VDB-369019 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/369019/cti
Third Party Advisory third-party-advisory
CVE-2026-11439 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-11439
Third Party Advisory third-party-advisory
Submit #822955 | theonedev onedev 15.05 BOPLA
https://vuldb.com/submit/822955
Related related
https://www.cnblogs.com/aibot/p/19994142
Scores
CVSS v3
6.3
EPSS
0.0021
EPSS Percentile
11.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-266
CWE-285
Status
published
Products (7)
theonedev/onedev
15.0.0
theonedev/onedev
15.0.1
theonedev/onedev
15.0.2
theonedev/onedev
15.0.3
theonedev/onedev
15.0.4
theonedev/onedev
15.0.5
theonedev/onedev
15.0.6
Published
Jun 06, 2026
Tracked Since
Jun 06, 2026