CVE-2026-11440

MEDIUM

theonedev REST API default-branch improper authorization

Title source: cna
STIX 2.1

Description

A vulnerability was determined in theonedev onedev up to 15.0.5. This affects an unknown part of the file /repositories/{projectId}/default-branch of the component REST API. This manipulation of the argument project.defaultBranch causes improper authorization. It is possible to initiate the attack remotely. Upgrading to version 15.0.6 is able to mitigate this issue. Upgrading the affected component is advised.

References (6)

Core 6
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-369020 | theonedev REST API default-branch improper authorization
https://vuldb.com/vuln/369020
Signature, Permissions Required signature permissions-required
VDB-369020 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/369020/cti
Third Party Advisory third-party-advisory
CVE-2026-11440 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-11440
Third Party Advisory third-party-advisory
Submit #822956 | theonedev onedev 15.05 BOPLA
https://vuldb.com/submit/822956

Scores

CVSS v3 6.3
EPSS 0.0021
EPSS Percentile 11.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-266 CWE-285
Status published
Products (7)
theonedev/onedev 15.0.0
theonedev/onedev 15.0.1
theonedev/onedev 15.0.2
theonedev/onedev 15.0.3
theonedev/onedev 15.0.4
theonedev/onedev 15.0.5
theonedev/onedev 15.0.6
Published Jun 06, 2026
Tracked Since Jun 06, 2026