Authorization Flaw in YosemiteCrew's Service and Task Management Platform

CVE-2026-59979

What is CVE-2026-59979?

YosemiteCrew's service and task management platform is susceptible to critical authorization flaws affecting both service catalogues and task libraries. Key routes, including PATCH and DELETE for services and tasks, lack necessary organization and permission validations. As a result, registered users can potentially manipulate another organization's data, posing a risk to data integrity, bookings, and billing. Furthermore, service records can be accessed without authentication, underscoring a significant breach in user data privacy. Earlier security updates failed to secure these routes fully, leaving important functionalities vulnerable to exploitation.

References