theonedev Pull Request issues canAccessIssue improper authorization
CVE-2026-11441

5.3MEDIUM

Key Information:

Vendor

Theonedev

Status
Onedev
Vendor
CVE Published:
6 June 2026

What is CVE-2026-11441?

A vulnerability was identified in theonedev onedev up to 15.0.5. This vulnerability affects the function canAccessIssue of the file /issues/ of the component Pull Request Handler. Such manipulation of the argument issue leads to improper authorization. It is possible to launch the attack remotely. Upgrading to version 15.0.6 is able to resolve this issue. It is advisable to upgrade the affected component.

Affected Version(s)

onedev 15.0.0

onedev 15.0.1

onedev 15.0.2

References

https://vuldb.com/vuln/369021
vdb-entrytechnical-description
https://vuldb.com/vuln/369021/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-11441
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

aibot88 (VulDB User)
.