Live › vulnerability › CVE-2026-119665
WHartTest 2.2.0 through 2.8.1 fails to check project ownership in its scheduled task and task execution endpoints. A logged-in user can change the project ID to another project's number to edit, delete, run, or read logs of that project's scheduled tasks.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Teams running WHartTest 2.2.0 through 2.8.1 with multiple projects and user accounts that share the instance. The sources describe authenticated users reaching other projects' tasks, so a single-project deployment or one where all users are fully trusted is less exposed. unknown for anything beyond that.
No product ranges from the sources yet.
2.2.0 to 2.8.1No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet that allows authenticated users to access other projects' tasks. Attackers can set project_pk to another project's sequential ID to modify, delete, or trigger scheduled tasks via run-now and read execution logs.
This page as .md · .json · in your agent: get_signal("CVE-2026-119665")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.