CVE-2026-111667 — REBUILD through 4.5.0 Missing Authorization via /project/comments/list Endpoint
REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments wi…
Published: 2026-10-16 · CVSS: 5.3 · CVSS 4.0
REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id of a task in a private project to the /project/comments/list endpoint to retrieve its comment content and attachment references.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7