Read the docs
TI-2026-84468 Aliases CVE-2026-63198

Privilege escalation in traQ OAuth2 silent authorization

Priority LOW 34CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

traQ before 3.28.3 is affected. Silent authorization requests with prompt=none and an empty or omitted scope check prior consent against an empty scope set, although all scopes registered for the client can be issued (CWE-863). An attacker controlling an OAuth client that receives authorization codes can target a user who consented to only some scopes and obtain a token with broader registered scopes without new consent. A user who never consented to the client still receives consent_required.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope set even though all scopes registered for the client become eligible for issuance. An attacker who controls an OAuth client capable of receiving authorization codes can target a user who previously consented to only some client scopes and obtain an access token containing broader registered scopes without additional consent. A user who has never consented to the client still receives consent_required. This issue is fixed in version 3.28.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00256 17th percentileScored 2026-11-07
Fix Fixed traQ (traPtitech): 3.28.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
traPtitechtraQbefore 3.28.33.28.3Patch availableCNA
  • traQ VendortraPtitech Affected before 3.28.3 Fixed in 3.28.3 Patch available CNA

Remediation

Upgrade traQ to version 3.28.3, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA traQ (traPtitech) Fixed in 3.28.3

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-63198
  2. 2026-11-03 CISA SSVC decision points changed
  3. 2026-11-03 Priority changed: MEDIUM → LOW

References

Other 3

  • TI-2026-84464 Cross-site scripting in traQ user uploaded file retrieval CVSS 3.1HIGH 7.3
  • TI-2025-35696 Insertion of Sensitive Information into Log File in github.com/traPtitech/traQ CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences