Authorization Bypass in Redmine Affecting Incoming Mail Handler

CVE-2021-31864

What is CVE-2021-31864?

This vulnerability allows attackers to bypass the 'add_issue_notes' permission check in Redmine by exploiting the incoming mail handler. Specifically, an attacker can manipulate how emails are processed, leading to unauthorized actions within the application. Users running affected versions should update to the latest stable release to mitigate this issue and enhance their security posture.

References