{"id":"CVE-2026-119665","title":"WHartTest 2.2.0 through 2.8.1 Missing Authorization via task_center Scheduled-Task APIs","summary":"WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet that allows authenticated users to access other projects' tasks. Attackers can set project_pk to another projec…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","cvssSource":"cna","cwe":["CWE-862"],"vendor":"MGdaasLab","product":"WHartTest","affected":["WHartTest >= 2.2.0 <= 2.8.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-30T15:21:27.447168Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T15:52:24.404Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119665","references":[{"url":"https://github.com/MGdaasLab/WHartTest/issues/166"},{"url":"https://github.com/MGdaasLab/WHartTest/blob/v2.8.1/WHartTest_Django/task_center/views.py#L19-L104"},{"url":"https://github.com/MGdaasLab/WHartTest/blob/v2.8.1/WHartTest_Django/task_center/views.py#L107-L133"},{"url":"https://hackmd.io/@hieuPenguinnn/wharttest-scheduled-task-cross-project-missing-authz-idor"},{"url":"https://github.com/MGdaasLab/WHartTest"},{"url":"https://www.vulncheck.com/advisories/wharttest-2.2.0-through-2.8.1-missing-authorization-via-task-center-scheduled-task-apis","label":"VulnCheck Advisory: WHartTest 2.2.0 through 2.8.1 Missing Authorization via task_center Scheduled-Task APIs"}],"tags":["cve.org"],"epss":0.00393,"epssPercentile":0.3366,"ingestedAt":"2026-11-05T16:07:30.505Z","slug":"CVE-2026-119665","body":"## Overview\n\nWHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet that allows authenticated users to access other projects' tasks. Attackers can set project_pk to another project's sequential ID to modify, delete, or trigger scheduled tasks via run-now and read execution logs.\n\n## Affected\n\n- `WHartTest >= 2.2.0 <= 2.8.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}