PT-2026-5019 · Git+1 · Taiga-Back

George Chen · CVE-2026-59097 · Published 2026-01-27 · Updated 2026-07-06

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Taiga versions prior to 6.10.2

Description Missing authorization allows unauthenticated remote attackers to create default due-date records in any project. This is achieved by exploiting unprotected POST endpoints on the user-story, task, and issue due-date API viewsets. By supplying an arbitrary project identifier, attackers can bypass permission checks and apply the AllowAny default, preventing project administrators from initializing due dates themselves.

Recommendations Update to version 6.10.2 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-59097

Affected Products

Taiga-Back

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59097.json · Exploit
• 🔥 https://github.com/taigaio/taiga-back/issues/244 · Exploit
• https://github.com/taigaio/taiga-back/commit/f925af424623350e04d4abc45bf1dc70e70c48a9 · Patch
• https://osv.dev/vulnerability/CVE-2026-59097 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-59097 · Security Note
• https://github.com/taigaio/taiga-back/pull/245 · Note
• https://github.com/taigaio/taiga-back/releases/tag/6.10.2 · Note
• https://github.com/taigaio/taiga-back · Note
• https://t.me/CVEtracker/58744 · Telegram Post
• https://twitter.com/infoflowcloud/status/2072815551961763991 · Twitter Post
• https://twitter.com/CVEnew/status/2072814588387873078 · Twitter Post
• https://twitter.com/CCBalert/status/2016198542822351176 · Twitter Post
• https://vulncheck.com/advisories/taiga-unauthorized-due-date-creation-via-api-viewsets · Note
• https://t.me/cveNotify/188811 · Telegram Post
• https://t.me/cveNotify/185603 · Telegram Post