CVE-2026-111667: REBUILD Authorization Bypass Vulnerability

CVE-2026-111667 Overview

CVE-2026-111667 is a missing authorization vulnerability [CWE-639] affecting REBUILD versions through 4.5.0. The flaw resides in the TaskCommentController.commentList method, which fails to verify project membership before returning task comment data. Authenticated low-privileged users can supply a task identifier belonging to a private project to the /project/comments/list endpoint and retrieve comment content along with attachment references. The issue is categorized as an Insecure Direct Object Reference (IDOR) and enables cross-project information disclosure within tenants of the REBUILD low-code platform.

Critical Impact
Any authenticated user can read comments and attachment metadata from tasks in private projects they have no membership in, exposing sensitive internal collaboration data.

Affected Products

REBUILD (getrebuild/rebuild) versions up to and including 4.5.0
TaskCommentController component in the project module
Deployments exposing the /project/comments/list endpoint to authenticated users

Discovery Timeline

2026-10-16 - CVE-2026-111667 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-111667

Vulnerability Analysis

REBUILD is an open-source business application platform that includes a project management module with task comments. The commentList handler in TaskCommentController accepts a task id parameter and returns the associated comments. The handler enforces authentication but omits an authorization check that confirms the requesting user is a member of the project owning the target task.

As a result, any session-authenticated account can enumerate task identifiers and request comments for tasks belonging to projects they do not participate in. The response discloses comment bodies and references to attached files, which may contain internal discussions, credentials, or confidential project artifacts.

Root Cause

The root cause is a missing object-level authorization check in the request-handling path. The controller trusts the caller's authenticated session but does not evaluate whether the authenticated principal has a membership relationship with the project associated with the supplied task id. This is a textbook Insecure Direct Object Reference pattern tracked as [CWE-639].

Attack Vector

Exploitation requires only low-privileged authenticated access over the network. An attacker enumerates or guesses numeric task identifiers and issues HTTP POST requests to the /project/comments/list endpoint with the target id. The server returns comment records regardless of project membership. Full technical analysis is available in the HackMD Project IDOR Analysis, the vulnerable GitHub Code Reference, and the VulnCheck Security Advisory.

// No verified exploit code published. See linked advisories for request structure.

Detection Methods for CVE-2026-111667

Indicators of Compromise

Repeated authenticated POST requests to /project/comments/list from a single account across many distinct task id values
Access to task comment resources by user accounts that have no membership record in the owning project
Sequential or enumerated numeric id parameters in request logs targeting the project comments endpoint

Detection Strategies

Correlate application access logs with project membership tables to flag commentList responses served to non-members
Alert on high-volume requests from a single session hitting the /project/comments/list endpoint with changing id parameters
Baseline normal per-user access patterns to the project module and detect deviations consistent with IDOR enumeration

Monitoring Recommendations

Enable verbose application-level audit logging on project and task endpoints, capturing user identity, task id, and response size
Forward REBUILD application and web server logs to a centralized analytics platform for cross-user correlation
Review attachment download events that follow comment list retrievals from unexpected accounts

How to Mitigate CVE-2026-111667

Immediate Actions Required

Upgrade REBUILD to a version later than 4.5.0 once a patched release is published by the maintainers
Restrict access to the REBUILD application to trusted authenticated users and reduce the number of low-privileged accounts
Audit project comment access logs for signs of enumeration against the /project/comments/list endpoint

Patch Information

No fixed version is referenced in the NVD entry at publication time. Monitor the getrebuild/rebuild GitHub repository and the VulnCheck Security Advisory for a vendor-supplied patch addressing the missing authorization check in TaskCommentController.commentList.

Workarounds

Place the REBUILD instance behind a reverse proxy that restricts the /project/comments/list path to users on an allowlist until a patch is applied
Apply a local source modification to TaskCommentController.commentList to validate project membership before returning comment data
Rotate or sanitize sensitive content stored in task comments and attachments if unauthorized access is suspected

bash

# Example reverse proxy restriction (nginx) limiting the vulnerable endpoint
location = /project/comments/list {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://rebuild_backend;
}