CVE-2026-65055
Taiga taiga-back Private Project Member Roster Disclosure via Unauthenticated filters_data Endpoints
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any private project by supplying a project ID to the filters_data API endpoints on UserStory, Task, Issue, and Epic viewsets. Attackers can send unauthenticated GET requests to the filters_data endpoints with sequential integer project IDs to enumerate private project membership details including user IDs, full names, and gravatar hashes, bypassing the access controls that correctly restrict other project API endpoints.
| CWE | CWE-862 |
| Vendor | taiga |
| Product | taiga-back |
| Published | Jul 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for taiga taiga-back
Be the first to know when new medium vulnerabilities affecting taiga taiga-back are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
Taiga / taiga-back
All versions affected References
Credits
🔍 George Chen