CVE-2026-69119 — Taubyte Tau v1.1.10 Missing Authorization via POST /projects/{id}
Taubyte Tau v1.1.10 contains a missing authorization vulnerability in the services/auth HTTP service that allows any authenticated user to read or permanently delete another ten…
Published: 2026-08-11 · CVSS: 7.2 · CVSS 4.0
Taubyte Tau v1.1.10 contains a missing authorization vulnerability in the services/auth HTTP service that allows any authenticated user to read or permanently delete another tenant's project by supplying an arbitrary project ID to the GET and DELETE /projects/{id} endpoints. The GitHubTokenHTTPAuth middleware only validates that a caller presents a valid GitHub OAuth token without verifying ownership or access rights to the target project, enabling attackers with any valid GitHub token to invoke bare KV-store operations such as projects.Fetch and project.Delete against any project ID to achieve cross-tenant project takeover.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7