---
id: CVE-2026-119665
title: >-
  WHartTest 2.2.0 through 2.8.1 Missing Authorization via task_center
  Scheduled-Task APIs
summary: >-
  WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability
  in ScheduledTaskViewSet and TaskExecutionViewSet that allows authenticated
  users to access other projects' tasks. Attackers can set project_pk to another
  projec…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-862
vendor: MGdaasLab
product: WHartTest
affected:
  - WHartTest >= 2.2.0 <= 2.8.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T15:21:27.447168Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T15:52:24.404Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119665'
references:
  - url: 'https://github.com/MGdaasLab/WHartTest/issues/166'
  - url: >-
      https://github.com/MGdaasLab/WHartTest/blob/v2.8.1/WHartTest_Django/task_center/views.py#L19-L104
  - url: >-
      https://github.com/MGdaasLab/WHartTest/blob/v2.8.1/WHartTest_Django/task_center/views.py#L107-L133
  - url: >-
      https://hackmd.io/@hieuPenguinnn/wharttest-scheduled-task-cross-project-missing-authz-idor
  - url: 'https://github.com/MGdaasLab/WHartTest'
  - url: >-
      https://www.vulncheck.com/advisories/wharttest-2.2.0-through-2.8.1-missing-authorization-via-task-center-scheduled-task-apis
    label: >-
      VulnCheck Advisory: WHartTest 2.2.0 through 2.8.1 Missing Authorization
      via task_center Scheduled-Task APIs
tags:
  - cve.org
epss: 0.00393
epssPercentile: 0.3366
ingestedAt: '2026-11-05T16:07:30.505Z'
---

## Overview

WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet that allows authenticated users to access other projects' tasks. Attackers can set project_pk to another project's sequential ID to modify, delete, or trigger scheduled tasks via run-now and read execution logs.

## Affected

- `WHartTest >= 2.2.0 <= 2.8.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.