CVE-2026-69119: Taubyte Tau v1.1.10 Missing Authorization via POST /projects/{id}
Taubyte Tau v1.1.10 contains a missing authorization vulnerability in the services/auth HTTP service that allows any authenticated user to read or permanently delete another tenant's project by supplying an arbitrary project ID to the GET and DELETE /projects/{id} endpoints. The GitHubTokenHTTPAuth middleware only validates that a caller presents a valid GitHub OAuth token without verifying ownership or access rights to the target project, enabling attackers with any valid GitHub token to invoke bare KV-store operations such as projects.Fetch and project.Delete against any project ID to achieve cross-tenant project takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Taubyte Tauto a version that resolves this vulnerability.Fixed in v1.1.10 - Compensating control
In the services/auth HTTP service, enforce authorization checks in front of GET /projects/{id} and DELETE /projects/{id} so that the GitHubTokenHTTPAuth middleware validates the caller’s ownership/access rights to the supplied {id} (not only that the OAuth token is valid) before calling projects.Fetch or project.Delete.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-69119?
CVE-2026-69119 has a severity rating of high, with a score of 8.3.
How do I fix CVE-2026-69119?
To fix CVE-2026-69119, ensure that proper authorization checks are implemented for access to the /projects/{id} endpoints.
What impact does CVE-2026-69119 have?
CVE-2026-69119 allows authenticated users to read or delete projects belonging to other tenants, leading to unauthorized access and potential data loss.
Which software is affected by CVE-2026-69119?
CVE-2026-69119 affects Taubyte Tau version 1.1.10.
When was CVE-2026-69119 published?
CVE-2026-69119 was published on August 11, 2026.