CVE-2026-10285: DevaslanPHP project-management Ticket KanbanScrumHelper.php recordUpdated improper authorization
A vulnerability has been found in DevaslanPHP project-management up to 2.0.0-beta1. Affected by this issue is the function KanbanScrumHelper::recordUpdated of the file app/Helpers/KanbanScrumHelper.php of the component Ticket Handler. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10285?
The severity of CVE-2026-10285 is medium with a score of 5.4.
What does CVE-2026-10285 affect?
CVE-2026-10285 affects the DevaslanPHP project-management system up to version 2.0.0-beta1.
How does CVE-2026-10285 impact authorization?
CVE-2026-10285 leads to improper authorization in the function KanbanScrumHelper::recordUpdated.
How can I mitigate the issue described in CVE-2026-10285?
To mitigate CVE-2026-10285, upgrade to a fixed version of DevaslanPHP that addresses the improper authorization.
Is CVE-2026-10285 remotely exploitable?
Yes, CVE-2026-10285 is remotely exploitable due to the affected function's access control issues.