CVE-2026-111667: REBUILD through 4.5.0 Missing Authorization via /project/comments/list Endpoint
REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id of a task in a private project to the /project/comments/list endpoint to retrieve its comment content and attachment references.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated low-privileged user can exploit it. The user does not need to be a member of the private project that contains the targeted task.
What does an attacker need to access private comments?
The attacker needs the ID of a task in a private project and can submit that ID to the /project/comments/list endpoint. Successful exploitation returns comment content and attachment references.
Are unauthenticated users affected?
The available information describes exploitation by authenticated users. It does not indicate that unauthenticated access is possible.
Which versions are known to be affected?
REBUILD through version 4.5.0 is affected. The provided information does not identify a fixed version.