CVE-2026-11441
MEDIUMtheonedev Pull Request issues canAccessIssue improper authorization
Title source: cnaDescription
A vulnerability was identified in theonedev onedev up to 15.0.5. This vulnerability affects the function canAccessIssue of the file /issues/ of the component Pull Request Handler. Such manipulation of the argument issue leads to improper authorization. It is possible to launch the attack remotely. Upgrading to version 15.0.6 is able to resolve this issue. It is advisable to upgrade the affected component.
References (6)
Core 6
Core References
Vdb Entry, Technical Description vdb-entry
technical-description
VDB-369021 | theonedev Pull Request issues canAccessIssue improper authorization
https://vuldb.com/vuln/369021
Signature, Permissions Required signature
permissions-required
VDB-369021 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/369021/cti
Third Party Advisory third-party-advisory
CVE-2026-11441 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-11441
Third Party Advisory third-party-advisory
Submit #822957 | theonedev onedev 15.05 BOPLA
https://vuldb.com/submit/822957
Related related
https://www.cnblogs.com/aibot/p/19994142
Scores
CVSS v3
6.3
EPSS
0.0021
EPSS Percentile
11.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-266
CWE-285
Status
published
Products (7)
theonedev/onedev
15.0.0
theonedev/onedev
15.0.1
theonedev/onedev
15.0.2
theonedev/onedev
15.0.3
theonedev/onedev
15.0.4
theonedev/onedev
15.0.5
theonedev/onedev
15.0.6
Published
Jun 06, 2026
Tracked Since
Jun 06, 2026