CVE-2026-11438: OneDev Auth Bypass Vulnerability

CVE-2026-11438 Overview

CVE-2026-11438 is an improper authorization vulnerability [CWE-266] in TheOneDev OneDev versions up to and including 15.0.5. The flaw resides in unspecified functionality reachable through the /projects endpoint. Manipulation of the project.forkedFromId parameter allows an authenticated remote attacker to bypass authorization checks and influence project fork relationships outside their permitted scope. The vendor addressed the issue in OneDev 15.0.6.

Critical Impact
An authenticated attacker can abuse the project.forkedFromId parameter over the network to perform actions that should require higher privileges, affecting confidentiality, integrity, and availability of project data.

Affected Products

TheOneDev OneDev versions up to 15.0.5
Fixed in TheOneDev OneDev 15.0.6
Self-hosted Git server and CI/CD deployments running affected OneDev releases

Discovery Timeline

2026-06-06 - CVE-2026-11438 published to the National Vulnerability Database (NVD)
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11438

Vulnerability Analysis

OneDev is a self-hosted Git server with built-in continuous integration and project management features. The vulnerability is an improper authorization weakness categorized as [CWE-266] Incorrect Privilege Assignment. The affected functionality lives behind the /projects route, where the project.forkedFromId parameter is processed without sufficient authorization enforcement. An authenticated user can submit a crafted request that references a project they should not be able to associate with, and the server accepts the operation.

The impact spans confidentiality, integrity, and availability at a limited scope. An attacker can manipulate fork lineage and project relationships, potentially exposing or modifying metadata of projects outside their access boundary. The attack is conducted remotely over the network and requires low privileges with no user interaction.

Root Cause

The root cause is missing or incomplete authorization validation on the project.forkedFromId argument when the /projects endpoint processes requests. The application trusts client-supplied object references without verifying that the requesting principal has rights over the referenced source project. This pattern aligns with broken access control over indirect object references.

Attack Vector

Exploitation requires network access to the OneDev web interface and a low-privileged authenticated account. The attacker issues a request to /projects with a manipulated project.forkedFromId value referencing a project outside their authorization scope. Because the published EPSS score is 0.043% at the 13.4 percentile, observed exploitation interest is low, but the exploit path is straightforward for any authenticated user.

No verified public proof-of-concept code is available. For technical details, refer to the VulDB CVE-2026-11438 entry and the VulDB #369018 CTI record.

Detection Methods for CVE-2026-11438

Indicators of Compromise

HTTP requests to /projects that include a project.forkedFromId parameter referencing project identifiers the requesting user does not own or collaborate on.
Unexpected creation or modification of fork relationships in OneDev audit logs.
Authenticated sessions issuing repeated /projects requests enumerating numeric forkedFromId values.

Detection Strategies

Review OneDev application logs for /projects requests where the authenticated user lacks read access to the referenced source project.
Correlate fork-creation events with the requesting user's project permissions to identify cross-tenant references.
Alert on bulk or sequential requests to /projects that suggest identifier enumeration of project.forkedFromId.

Monitoring Recommendations

Enable verbose access logging on the OneDev reverse proxy and forward logs to a centralized SIEM for retention and analysis.
Monitor for changes to project fork lineage outside expected developer workflows.
Track authentication events from low-privileged accounts that suddenly interact with the /projects administrative surface.

How to Mitigate CVE-2026-11438

Immediate Actions Required

Upgrade OneDev to version 15.0.6 or later, which contains the official fix.
Audit existing projects for unauthorized fork relationships created before the upgrade.
Review and tighten OneDev user roles, removing unused or excessive low-privileged accounts.

Patch Information

The vendor released the fix in OneDev 15.0.6. Download the patched build and release notes from the OneDev GitHub Release v15.0.6. Upgrading the affected component is the recommended remediation.

Workarounds

Restrict network access to the OneDev /projects endpoint using an upstream reverse proxy or web application firewall while patching is scheduled.
Disable or limit self-service account registration to reduce the pool of authenticated users who could abuse the flaw.
Require multi-factor authentication for all OneDev users to raise the cost of obtaining the low-privileged access needed for exploitation.

bash

# Configuration example: upgrade OneDev container to the patched release
docker pull 1dev/server:15.0.6
docker stop onedev && docker rm onedev
docker run -d --name onedev \
  -v /var/onedev:/opt/onedev \
  -p 6610:6610 -p 6611:6611 \
  1dev/server:15.0.6