Missing Authorization in Taubyte Tau Allows Unauthorized Access to Projects
CVE-2026-69119

7.2HIGH

Key Information:

Vendor: Taubyte
Status: Tau
Vendor: CVE Published:; 11 August 2026

What is CVE-2026-69119?

Taubyte Tau v1.1.10 has a vulnerability in its services/auth HTTP service that allows authenticated users to access unauthorized projects. By using a valid GitHub OAuth token, users can perform GET and DELETE operations on any project by simply specifying an arbitrary project ID. This weakness enables potential attackers to read or permanently delete projects belonging to other tenants, resulting in a risk of cross-tenant project takeover. The issue arises from the lack of proper verification for ownership or access rights within the GitHubTokenHTTPAuth middleware.