CVE-2026-104991: Phproject < 1.8.7 Missing Authorization via Issues REST API
Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints (singleget, singlecomments, singlecommentspost) that allows authenticated API key holders to bypass the security.restrictaccess confidentiality control by never invoking the allowAccess() authorization routine. Attackers can use a valid API key to read restricted issue contents and comments, including owner and author email addresses, and post unauthorized comments to issues they should not have access to.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Phprojectto a version that resolves this vulnerability.Fixed in 1.8.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a valid Phproject API key. No user interaction is required, and the affected REST API endpoints are network-accessible.
What data and actions are exposed through the vulnerable endpoints?
A valid API key holder can read restricted issue contents and comments, including owner and author email addresses. They can also post comments to issues they are not authorized to access.
Does enabling the security.restrict_access confidentiality control prevent exploitation?
No. The vulnerable issue API endpoints bypass that control because they do not invoke the allowAccess() authorization routine.
Which endpoints should be treated as affected when reviewing API exposure?
The affected issue REST API endpoints are single_get, single_comments, and single_comments_post. Review API-key activity against these endpoints for access to restricted issues and unauthorized comment creation.
What version resolves the issue?
Phproject 1.8.7 addresses the vulnerability. Versions before 1.8.7 are affected.