CVE-2026-11439 Overview
CVE-2026-11439 is an improper authorization vulnerability [CWE-266] in theonedev OneDev versions up to and including 15.0.5. The flaw resides in the Parent Project Handler component, accessible through the /projects/ endpoint. Attackers can manipulate the project.parentId argument to bypass authorization controls and operate on parent project relationships outside their permitted scope. The issue is remotely exploitable by authenticated users with low privileges and does not require user interaction. OneDev maintainers addressed the vulnerability in version 15.0.6.
Critical Impact
Authenticated remote attackers can manipulate the project.parentId parameter to subvert authorization boundaries in OneDev, affecting the confidentiality, integrity, and availability of project hierarchies.
Affected Products
- theonedev OneDev versions up to 15.0.5
- Component: Parent Project Handler (/projects/ endpoint)
- Fixed in OneDev 15.0.6
Discovery Timeline
- 2026-06-06 - CVE-2026-11439 published to NVD
- 2026-06-08 - Last updated in NVD database
Technical Details for CVE-2026-11439
Vulnerability Analysis
The vulnerability exists in the Parent Project Handler of OneDev, a self-hosted Git server and CI/CD platform. The handler processes requests at the /projects/ endpoint and accepts a project.parentId argument that designates the parent project for a given project resource. The application fails to verify whether the requesting user possesses sufficient authorization to associate a project with the specified parent. An authenticated attacker with limited project privileges can supply a parentId referencing a project they should not control. The result is improper authorization classified as [CWE-266] (Incorrect Privilege Assignment). Because OneDev enforces permissions hierarchically through parent projects, manipulating this relationship can grant attackers indirect access to administrative or sibling project resources.
Root Cause
The root cause is missing or insufficient authorization checks on the project.parentId parameter inside the Parent Project Handler. The application trusts the client-supplied parent identifier without confirming the actor has rights over both the child project and the target parent project. This breaks the privilege-inheritance model OneDev relies upon for access control.
Attack Vector
Exploitation proceeds over the network against an authenticated session with low privileges. The attacker submits a crafted request to /projects/ containing a project.parentId value pointing to a privileged or unrelated parent project. No user interaction is required. Successful exploitation yields limited impact on confidentiality, integrity, and availability of the targeted project hierarchy, as reflected in the CVSS 4.0 vector. No public proof-of-concept exploit is currently listed, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog.
No verified exploitation code is available. See the VulDB CVE-2026-11439 entry and the GitHub Release v15.0.6 for technical references.
Detection Methods for CVE-2026-11439
Indicators of Compromise
- Unexpected modifications to project parent relationships in the OneDev audit log, especially changes performed by users without administrative rights.
- HTTP POST or PUT requests to /projects/ containing a project.parentId value that references projects outside the requester's normal scope.
- Sudden appearance of nested projects under unrelated parent projects, or unauthorized inheritance of permissions.
Detection Strategies
- Review OneDev application logs for /projects/ requests where the supplied project.parentId does not match the requesting account's permitted projects.
- Correlate project hierarchy changes with the actor identity and verify the actor holds maintainer or owner roles on both the child and target parent.
- Alert on anomalous spikes in project creation or re-parenting events from non-administrative users.
Monitoring Recommendations
- Enable verbose audit logging in OneDev and forward events to a centralized log platform for retention and analysis.
- Continuously baseline project hierarchy state and trigger alerts on unexpected parentId transitions.
- Monitor authentication events for low-privilege accounts performing project administration operations.
How to Mitigate CVE-2026-11439
Immediate Actions Required
- Upgrade OneDev to version 15.0.6 or later, which contains the official fix for CVE-2026-11439.
- Audit existing project hierarchies for unauthorized parent assignments performed prior to patching.
- Review and tighten role assignments so only trusted users hold project administration privileges.
Patch Information
OneDev 15.0.6 resolves CVE-2026-11439. Download and release notes are available at the OneDev GitHub Release v15.0.6. Administrators should apply the upgrade following the project's standard upgrade procedure and verify the running version after deployment.
Workarounds
- Restrict access to the OneDev instance using network controls, allowing only trusted users to reach the /projects/ endpoint until patching completes.
- Temporarily reduce the number of accounts with project creation or modification privileges to limit the exploitation surface.
- Place OneDev behind a reverse proxy or web application firewall configured to inspect and log requests containing the project.parentId parameter.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
