Live › vulnerability › CVE-2026-111667
Go to dashboardREBUILD through 4.5.0 has a missing authorization check in the task comment listing endpoint. An authenticated low-privileged user can request comments and attachment references for tasks in private projects they do not belong to.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run REBUILD with more than one class of user and keep private projects on the same instance. A single-user or fully trusted deployment is less exposed. The sources do not name a patched version.
No product ranges from the sources yet.
4.5.0; versions through 4.5.0 are affected./project/comments/list is reachable by ordinary authenticated users.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id of a task in a private project to the /project/comments/list endpoint to retrieve its comment content and attachment references.
This page as .md · .json · in your agent: get_signal("CVE-2026-111667")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.