Improper Authorization in DevaslanPHP Project Management
CVE-2026-10284

5.3MEDIUM

Key Information:

Vendor

DevaslanPHP

Status
Project-management
Vendor
CVE Published:
1 June 2026

What is CVE-2026-10284?

A vulnerability exists in the DevaslanPHP project-management system up to version 2.0.0-beta1 affecting the Livewire Handler. Specifically, the issue is located within the editComment/doDeleteComment functions in the ViewTicket.php file. This flaw allows remote attackers to manipulate the system and gain improper authorization, increasing the risk of unauthorized access to sensitive data. The project maintainers have been made aware of the problem but have yet to address it publicly.

Affected Version(s)

project-management 2.0.0-beta1

References

https://vuldb.com/vuln/367577
vdb-entrytechnical-description
https://vuldb.com/vuln/367577/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-10284
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mitchell45 (VulDB User)
VulDB CNA Team
.