theonedev Parent Project projects improper authorization
CVE-2026-11439

5.3MEDIUM

Key Information:

Vendor

Theonedev

Status
Onedev
Vendor
CVE Published:
6 June 2026

What is CVE-2026-11439?

A vulnerability was found in theonedev onedev up to 15.0.5. Affected by this issue is some unknown functionality of the file /projects/ of the component Parent Project Handler. The manipulation of the argument project.parentId results in improper authorization. The attack may be performed from remote. Upgrading to version 15.0.6 can resolve this issue. It is recommended to upgrade the affected component.

Affected Version(s)

onedev 15.0.0

onedev 15.0.1

onedev 15.0.2

References

https://vuldb.com/vuln/369019
vdb-entrytechnical-description
https://vuldb.com/vuln/369019/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-11439
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

aibot88 (VulDB User)
.