DevaslanPHP project-management Ticket KanbanScrumHelper.php recordUpdated improper authorization
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Privilege escalation, Security bypass
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-266 and CWE-285.
Summary
A vulnerability has been found in DevaslanPHP project-management up to 2.0.0-beta1. Affected by this issue is the function KanbanScrumHelper::recordUpdated of the file app/Helpers/KanbanScrumHelper.php of the component Ticket Handler. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| DevaslanPHP | project-management | 2.0.0-beta1 | — | No fix listed | CNA |
- project-management VendorDevaslanPHP Affected 2.0.0-beta1 Fixed in — No fix listed CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:devaslanphp:project-management:*:*:*:*:*:*:*:* | — | — | DevaslanPHP |
- cpe:2.3:a:devaslanphp:project-management:*:*:*:*:*:*:*:* Versions — — ·DevaslanPHP
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-10285
- 2026-10-03 Alias added: GHSA-9xj7-hrc2-w62q
References
More DevaslanPHP vulnerabilities
- TI-2025-32505 A stored cross-site scripting (XSS) vulnerability exists in DevaslanPHP… CVSS 3.1HIGH 7.6
- TI-2026-65037 DevaslanPHP project-management Timesheet Dashboard MonthlyReport.php whereRaw sql injection CVSS 4.0MEDIUM 5.3
- TI-2026-65036 DevaslanPHP project-management Timesheet Dashboard ActivitiesReport.php whereRaw sql injection CVSS 4.0MEDIUM 5.3
- TI-2026-65038 DevaslanPHP project-management Jira Import jira-import updateJiraProjects server-side request forgery CVSS 4.0MEDIUM 5.1
- TI-2026-09020 DevaslanPHP project-management Livewire ViewTicket.php doDeleteComment improper authorization CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-10285 · CVE Program
- CVE-2026-10285 · NVD
- FIRST EPSS
- GHSA-9xj7-hrc2-w62q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences