Read the docs
TI-2026-66155 Aliases CVE-2026-104991GHSA-697f-vmv6-cx6w

Phproject < 1.8.7 Missing Authorization via Issues REST API

Priority MEDIUM 64CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints (single_get, single_comments, single_comments_post) that allows authenticated API key holders to bypass the security.restrict_access confidentiality control by never invoking the allowAccess() authorization routine. Attackers can use a valid API key to read restricted issue contents and comments, including owner and author email addresses, and post unauthorized comments to issues they should not have access to.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00318 24th percentileScored 2026-11-07
Fix Fixed phproject (Alanaktion): 1.8.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Alanaktionphproject1.1.6 to before 1.8.71.8.7Patch availableCNA
  • phproject VendorAlanaktion Affected 1.1.6 to before 1.8.7 Fixed in 1.8.7 Patch available CNA

Remediation

  • Fix · CNA phproject (Alanaktion) Fixed in 1.8.7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-104991
  2. 2026-10-03 Alias added: GHSA-697f-vmv6-cx6w
  3. 2026-10-04 Priority changed: MEDIUM → LOW
  4. 2026-10-06 CISA SSVC decision points changed
  5. 2026-10-06 Priority changed: LOW → MEDIUM

References

Advisory 1

Other 1

  • TI-2025-35653 Stored XSS in “hours” fields when creating or editing an issue, using SQLite database CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences