CVE-2026-104991

HIGH

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints (single_get, single_comments, single_comments_post) that allows authenticated API key holders to bypass the security.restrict_access confidentiality control by never invoking the allowAccess() authorization routine. Attackers can use a valid API key to read restricted issue contents and comments, including owner and author email addresses, and post unauthorized comments to issues they should not have access to.

CVSS v3.1 Score

7.1
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Attack Vector
NETWORK
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
LOW
Availability
NONE
Published: 10/2/2026Modified: 10/6/2026

Related Intelligence (1)

HIGHVulnerability

NVD HIGH: CVE-2026-104991 — Phproject before 1.8.7 contains a missing object-level authorization vulnerabili...

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints (single_get, single_comments, single_comments_post) that allows authenticated API key holders to bypass the security.restrict_access confidentiality control by never invoking the allowAccess() authorization routine. Attackers can use a valid API key to read restricted issue contents a

CVE-2026-104991
NIST NVD

References (4)

https://github.com/Alanaktion/phproject/releases/tag/v1.8.7https://github.com/Alanaktion/phproject/security/advisories/GHSA-mpq9-v47x-3hw8https://www.vulncheck.com/advisories/phproject-missing-authorization-via-issues-rest-apihttps://github.com/Alanaktion/phproject/security/advisories/GHSA-mpq9-v47x-3hw8