{"id":"CVE-2026-59097","title":"Taiga < 6.10.2 - Unauthorized Due-Date Creation via API Viewsets","summary":"Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project by exploiting unprotected POST endpoints on the user-story, task, and issue…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-862"],"vendor":"taiga","product":"taiga-back","affected":["taiga-back < 6.10.2"],"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-07-06T14:50:31.230166Z"},"exploitAvailable":true,"published":"2026-07-02","updated":"2026-11-08","sourceUpdated":"2026-11-08T14:07:18.885Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-59097","references":[{"url":"https://github.com/taigaio/taiga-back/releases/tag/6.10.2","label":"taiga-back 6.10.2 Release Notes"},{"url":"https://github.com/taigaio/taiga-back/issues/244","label":"Researcher Disclosure"},{"url":"https://github.com/taigaio/taiga-back/pull/245","label":"Fix PR"},{"url":"https://github.com/taigaio/taiga-back/commit/f925af424623350e04d4abc45bf1dc70e70c48a9","label":"Fix Commit"},{"url":"https://www.vulncheck.com/advisories/taiga-unauthorized-due-date-creation-via-api-viewsets"}],"tags":["cve.org","exploit-available"],"epss":0.00429,"epssPercentile":0.37424,"ingestedAt":"2026-11-08T14:51:22.286Z","slug":"CVE-2026-59097","body":"## Overview\n\nTaiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project by exploiting unprotected POST endpoints on the user-story, task, and issue due-date API viewsets. Attackers can supply an arbitrary project identifier to these endpoints, which bypass permission checks and apply the AllowAny default, to pre-empt project administrators from initializing due dates by creating records before they can do so themselves.\n\n## Affected\n\n- `taiga-back < 6.10.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}