CVE-2026-119665: WHartTest 2.2.0 through 2.8.1 Missing Authorization via task_center Scheduled-Task APIs
WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet that allows authenticated users to access other projects' tasks. Attackers can set projectpk to another project's sequential ID to modify, delete, or trigger scheduled tasks via run-now and read execution logs.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WHartTest user who can reach the affected ScheduledTaskViewSet or TaskExecutionViewSet APIs may exploit it. The attacker does not need interaction from another user, but needs a target project's sequential ID.
What actions can an attacker perform against another project?
An attacker can use another project's project_pk value to access that project's scheduled tasks. This can allow modification, deletion, or immediate execution of scheduled tasks through run-now, as well as reading task execution logs.
How can I determine whether my deployment is affected?
Deployments using WHartTest versions 2.2.0 through 2.8.1 are affected. Verify whether a low-privileged authenticated user can supply a different project's project_pk to the scheduled-task or task-execution API endpoints and receive or alter that project's data.