---
id: CVE-2026-65055
title: >-
  Taiga 6.10.1 contains a missing authorization vulnerability that allows
  unauthenticated attackers to disclose the full member roster and internal
  workflow configuration of any private project by supplying a project ID to the
  filters_data…
summary: >-
  Taiga 6.10.1 contains a missing authorization vulnerability that allows
  unauthenticated attackers to disclose the full member roster and internal
  workflow configuration of any private project by supplying a project ID to the
  filters_data…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-862
vendor: Taiga
product: taiga-back
affected:
  - taiga-back 6.10.1
published: '2026-07-21'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T18:18:38.593'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-65055'
references:
  - url: 'https://github.com/taigaio/taiga-back'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/taigaio/taiga-back/issues/246'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/taiga-taiga-back-private-project-member-roster-disclosure-via-unauthenticated-filters-data-endpoints
    label: disclosure@vulncheck.com
  - url: 'https://github.com/taigaio/taiga-back/issues/246'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00326
epssPercentile: 0.25489
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-07-23T14:11:19.643713Z'
ingestedAt: '2026-09-24T15:45:56.722Z'
---

## Overview

Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any private project by supplying a project ID to the filters_data API endpoints on UserStory, Task, Issue, and Epic viewsets. Attackers can send unauthenticated GET requests to the filters_data endpoints with sequential integer project IDs to enumerate private project membership details including user IDs, full names, and gravatar hashes, bypassing the access controls that correctly restrict other project API endpoints.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.