{"id":"CVE-2026-111667","kind":"vulnerability","aliases":["CVE-2026-111667"],"related":[],"title":"REBUILD: low-privileged users can read private project task comments","description":"REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id of a task in a private project to the /project/comments/list endpoint to retrieve its comment content and attachment references.","summary":"REBUILD through 4.5.0 has a missing authorization check in the task comment listing endpoint. An authenticated low-privileged user can request comments and attachment references for tasks in private projects they do not belong to.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","project-management","rebuild","self-hosted"],"not_affected_if":["no-private-projects","single-user-instance"],"how_to_check":"- Check the installed REBUILD version against `4.5.0`; versions through 4.5.0 are affected.\n- Review whether `/project/comments/list` is reachable by ordinary authenticated users.","fix":"- unknown","status":"open","published_at":"2026-10-16T18:17:48+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:27:07+00:00","updated_at":"2026-10-25T04:27:07+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:27:07Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"REBUILD: low-privileged users can read private project task comments","impact":"medium","summary":"REBUILD through 4.5.0 has a missing authorization check in the task comment listing endpoint. An authenticated low-privileged user can request comments and attachment references for tasks in private projects they do not belong to.","category":"package","nicknames":[],"who_cares":["rebuild","self-hosted","project-management"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads task comments and attachment references from private projects","analyst_note":"Find the fixed REBUILD release and confirm the vendor advisory for CVE-2026-111667; the NVD entry lists no patch version.","how_to_check":"- Check the installed REBUILD version against `4.5.0`; versions through 4.5.0 are affected.\n- Review whether `/project/comments/list` is reachable by ordinary authenticated users.","needs_analyst":true,"not_affected_if":["single-user-instance","no-private-projects"],"who_is_affected":"Teams that run REBUILD with more than one class of user and keep private projects on the same instance. A single-user or fully trusted deployment is less exposed. The sources do not name a patched version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000567,"input_tokens":3327,"output_tokens":468,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111667':14A,17A '-2026':13A,16A '/project/comments/list':100C '4.5.0':28B,63C 'allow':72C 'attach':50B,108C 'attack':86C 'authent':41B,73C 'author':32B,67C 'belong':60B 'check':33B,85C 'comment':11A,37B,48B,81C,105C 'contain':64C 'content':106C 'cve':12A,15A 'endpoint':39B,101C 'host':25B 'id':90C 'list':38B 'low':3A,43B,75C 'low-privileg':2A,42B,74C 'manag':21B 'membership':84C 'miss':31B,66C 'packag':18B 'privat':8A,55B,96C 'privileg':4A,44B,76C 'project':9A,20B,56B,83C,97C 'project-manag':19B 'read':7A,79C 'rebuild':1A,22B,26B,61C 'refer':51B,109C 'request':47B 'retriev':103C 'self':24B 'self-host':23B 'suppli':88C 'task':10A,36B,53B,80C,93C 'taskcommentcontroller.commentlist':70C 'user':5A,45B,77C 'vulner':68C 'without':82C","nicknames":[],"mitigations":[],"who_affected":"Teams that run REBUILD with more than one class of user and keep private projects on the same instance. A single-user or fully trusted deployment is less exposed. The sources do not name a patched version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111667","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111667","severity":null,"published_at":"2026-10-16T18:17:48+00:00","modified_at":"2026-10-16T19:17:04+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}