CVE-2026-11440: OneDev Auth Bypass Vulnerability

CVE-2026-11440 Overview

CVE-2026-11440 is an improper authorization vulnerability [CWE-266] in theonedev OneDev through version 15.0.5. The flaw resides in the REST API endpoint /repositories/{projectId}/default-branch, where manipulation of the project.defaultBranch argument bypasses authorization controls. An authenticated remote attacker with low privileges can alter the default branch of repositories they should not be able to modify. The issue is fixed in OneDev 15.0.6. OneDev is a self-hosted Git server with built-in CI/CD and Kanban features, so unauthorized changes to default branches can disrupt development workflows and integrity controls.

Critical Impact
Authenticated attackers can remotely modify a repository's default branch through the REST API without proper authorization, affecting code integrity and CI/CD pipeline behavior.

Affected Products

theonedev OneDev versions up to and including 15.0.5
OneDev REST API component handling /repositories/{projectId}/default-branch
Fixed in OneDev 15.0.6

Discovery Timeline

2026-06-06 - CVE-2026-11440 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11440

Vulnerability Analysis

The vulnerability lies in the REST API handler for /repositories/{projectId}/default-branch. When the endpoint processes the project.defaultBranch parameter, it does not correctly enforce authorization checks against the requesting principal's privileges on the target project. As a result, a user with limited access can submit a crafted request and change the default branch setting of a repository they do not own or administer.

Default branch settings have downstream effects in OneDev. Branch protection rules, pull request targets, and CI/CD pipeline triggers commonly key off the default branch. Reassigning this value lets an attacker redirect builds, bypass merge protections, or surface attacker-controlled branches as the canonical reference seen by collaborators and automation.

The weakness maps to CWE-266: Incorrect Privilege Assignment. It is exploitable over the network with low privileges and no user interaction.

Root Cause

The root cause is missing or insufficient authorization enforcement at the REST API layer for the default-branch modification path. The handler trusts the caller's session for authentication but does not verify that the principal holds project-administration rights before persisting the project.defaultBranch change.

Attack Vector

An attacker authenticates to a OneDev instance with any low-privileged account, including accounts created through self-registration where enabled. The attacker then issues an HTTP request to /repositories/{projectId}/default-branch for a target project and supplies a project.defaultBranch value. The server applies the change without validating the caller's authorization on the targeted project.

The vulnerability is described in prose only; see the GitHub Release Note v15.0.6 and the VulDB entry for CVE-2026-11440 for further technical context.

Detection Methods for CVE-2026-11440

Indicators of Compromise

HTTP requests to /repositories/{projectId}/default-branch originating from accounts that do not hold administrative roles on the targeted project.
Unexpected changes to the defaultBranch field in OneDev audit logs or project settings history.
CI/CD pipeline runs triggered against branches that were not previously the project default.

Detection Strategies

Review OneDev access logs for PUT or POST requests to the default-branch REST endpoint and correlate the caller identity with project permission state at the time of the request.
Alert on default-branch changes that are not paired with a corresponding administrative action by an authorized user.
Inspect Git server reflogs for default-branch reassignments that lack matching change tickets or pull request approvals.

Monitoring Recommendations

Forward OneDev application and access logs to a centralized logging or SIEM platform and build rules for default-branch modification events.
Track repository configuration drift by hashing or snapshotting project settings and alerting on unauthorized deltas.
Monitor authentication events for low-privileged accounts that interact with administrative REST endpoints.

How to Mitigate CVE-2026-11440

Immediate Actions Required

Upgrade OneDev to version 15.0.6 or later, as published in the upstream release notes.
Audit all OneDev projects for unauthorized default-branch changes since the deployment of any version at or below 15.0.5.
Restrict network exposure of the OneDev REST API to trusted networks while patching is scheduled.

Patch Information

The vendor addressed the authorization flaw in OneDev 15.0.6. Refer to the GitHub Release Note v15.0.6 for upgrade instructions and changelog details. Upgrading the affected component is the recommended remediation per the advisory.

Workarounds

Disable self-service account registration to limit the pool of authenticated users that can reach the vulnerable endpoint.
Place the OneDev instance behind a reverse proxy or WAF and block requests to /repositories/{projectId}/default-branch from non-administrative users until the patch is applied.
Review and tighten per-project role assignments so low-privileged accounts cannot retain sessions against sensitive repositories.

bash

# Example: block the vulnerable REST path at an upstream nginx proxy
# until OneDev is upgraded to 15.0.6
location ~* ^/repositories/[^/]+/default-branch$ {
    return 403;
}