CVE-2026-65055

MEDIUM

Taiga taiga-back Private Project Member Roster Disclosure via Unauthenticated filters_data Endpoints

Title source: cna

Description

Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any private project by supplying a project ID to the filters_data API endpoints on UserStory, Task, Issue, and Epic viewsets. Attackers can send unauthenticated GET requests to the filters_data endpoints with sequential integer project IDs to enumerate private project membership details including user IDs, full names, and gravatar hashes, bypassing the access controls that correctly restrict other project API endpoints.

References (3)

Core 3

Core References

Product product

GitHub Issue

https://github.com/taigaio/taiga-back/issues/246

Patch patch

Product

https://github.com/taigaio/taiga-back

Third Party Advisory third-party-advisory

https://www.vulncheck.com/advisories/taiga-taiga-back-private-project-member-roster-disclosure-via-unauthenticated-filters-data-endpoints

Scores

CVSS v3 5.3

EPSS 0.0025

EPSS Percentile 16.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (1)

Taiga/taiga-back 6.10.1

Published Jul 21, 2026

Tracked Since Jul 22, 2026