CVE-2026-111667

Published: Oct 16, 2026Modified: Oct 16, 2026Deferred

5.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id of a task in a private project to the /project/comments/list endpoint to retrieve its comment content and attachment references.

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (4)

https://github.com/getrebuild/rebuild/blob/4.5.0/src/main/java/com/rebuild/web/project/TaskCommentController.java#L37-L62

Source: disclosure@vulncheck.com

https://hackmd.io/@hieuPenguinnn/getrebuild-rebuild-project-task-comment-idor

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/rebuild-through-4.5.0-missing-authorization-via-project-comments-list-endpoint

Source: disclosure@vulncheck.com

https://hackmd.io/@hieuPenguinnn/getrebuild-rebuild-project-task-comment-idor

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.