CVE-2026-11439: theonedev Parent Project projects improper authorization
A vulnerability was found in theonedev onedev up to 15.0.5. Affected by this issue is some unknown functionality of the file /projects/ of the component Parent Project Handler. The manipulation of the argument project.parentId results in improper authorization. The attack may be performed from remote. Upgrading to version 15.0.6 can resolve this issue. It is recommended to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
theonedev/onedevto a version that resolves this vulnerability.Fixed in 15.0.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11439?
The severity of CVE-2026-11439 is medium with a score of 6.3.
How do I fix CVE-2026-11439?
To fix CVE-2026-11439, update OneDev to version 15.0.6 or later.
What type of vulnerability is CVE-2026-11439?
CVE-2026-11439 is an improper authorization vulnerability in OneDev.
Which component is affected by CVE-2026-11439?
CVE-2026-11439 affects the Parent Project Handler component of the OneDev software.
Can CVE-2026-11439 be exploited remotely?
Yes, the attack for CVE-2026-11439 can be performed remotely.