---
id: CVE-2026-59097
title: Taiga < 6.10.2 - Unauthorized Due-Date Creation via API Viewsets
summary: >-
  Taiga before 6.10.2 contains a missing authorization vulnerability that allows
  unauthenticated remote attackers to create default due-date records in any
  project by exploiting unprotected POST endpoints on the user-story, task, and
  issue…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: taiga
product: taiga-back
affected:
  - taiga-back < 6.10.2
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-07-06T14:50:31.230166Z'
exploitAvailable: true
published: '2026-07-02'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:07:18.885Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-59097'
references:
  - url: 'https://github.com/taigaio/taiga-back/releases/tag/6.10.2'
    label: taiga-back 6.10.2 Release Notes
  - url: 'https://github.com/taigaio/taiga-back/issues/244'
    label: Researcher Disclosure
  - url: 'https://github.com/taigaio/taiga-back/pull/245'
    label: Fix PR
  - url: >-
      https://github.com/taigaio/taiga-back/commit/f925af424623350e04d4abc45bf1dc70e70c48a9
    label: Fix Commit
  - url: >-
      https://www.vulncheck.com/advisories/taiga-unauthorized-due-date-creation-via-api-viewsets
tags:
  - cve.org
  - exploit-available
epss: 0.00429
epssPercentile: 0.37424
ingestedAt: '2026-11-08T14:51:22.286Z'
---

## Overview

Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project by exploiting unprotected POST endpoints on the user-story, task, and issue due-date API viewsets. Attackers can supply an arbitrary project identifier to these endpoints, which bypass permission checks and apply the AllowAny default, to pre-empt project administrators from initializing due dates by creating records before they can do so themselves.

## Affected

- `taiga-back < 6.10.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.