CVE-2026-11441 Overview
CVE-2026-11441 is an improper authorization vulnerability [CWE-266] in TheOneDev OneDev through version 15.0.5. The flaw resides in the canAccessIssue function within the /issues/ path of the Pull Request Handler component. An authenticated remote attacker can manipulate the issue argument to bypass authorization checks and access issue data outside of their permitted scope. The vendor resolved the issue in OneDev 15.0.6.
Critical Impact
Authenticated remote attackers can bypass access controls in the Pull Request Handler to view or interact with issues they are not authorized to access, exposing repository data confidentiality and integrity.
Affected Products
- TheOneDev OneDev versions up to and including 15.0.5
- Component: Pull Request Handler (/issues/ endpoint)
- Function: canAccessIssue
Discovery Timeline
- 2026-06-06 - CVE-2026-11441 published to NVD
- 2026-06-08 - Last updated in NVD database
Technical Details for CVE-2026-11441
Vulnerability Analysis
The vulnerability exists in OneDev, a self-hosted Git server with continuous integration and issue tracking. The canAccessIssue function in the Pull Request Handler fails to enforce proper authorization when evaluating the issue argument. As a result, a low-privileged authenticated user can submit crafted requests referencing issues outside their permission boundary and receive unauthorized access.
The weakness is classified under [CWE-266] (Incorrect Privilege Assignment). The attack is exploitable over the network with low complexity and requires only low privileges. No user interaction is needed, and impact spans confidentiality, integrity, and availability at limited levels.
According to public references on VulDB, the issue was disclosed publicly alongside the vendor's 15.0.6 release. There are no confirmed in-the-wild exploitations and the EPSS percentile remains low, indicating limited active interest at this time.
Root Cause
The root cause is a missing or incomplete authorization check in the canAccessIssue function. The function does not adequately verify whether the requesting principal holds the privileges required to access the supplied issue identifier before returning data through the Pull Request Handler.
Attack Vector
An attacker with a valid low-privilege account on a vulnerable OneDev instance issues a network request to the /issues/ endpoint with a manipulated issue parameter. The handler invokes canAccessIssue, which fails to reject the request, and returns information or permits actions tied to the targeted issue. Refer to the VulDB advisory for technical context. No verified proof-of-concept code is published at this time.
Detection Methods for CVE-2026-11441
Indicators of Compromise
- Repeated authenticated requests to the /issues/ endpoint referencing issue identifiers across multiple unrelated projects from a single account.
- HTTP responses returning issue content to users without explicit project membership in OneDev audit logs.
- Spikes in pull request and issue access activity from accounts with minimal historical interaction.
Detection Strategies
- Review OneDev application logs for access patterns where one principal enumerates sequential or non-sequential issue IDs spanning multiple projects.
- Correlate web access logs with OneDev's role and permission model to identify accesses that should have been denied.
- Compare deployed OneDev versions against 15.0.6 using software inventory data to identify unpatched instances.
Monitoring Recommendations
- Enable verbose authorization logging in OneDev and forward logs to a centralized log analytics platform for retention and correlation.
- Alert on anomalous access volumes against the Pull Request Handler endpoint, particularly from newly created or low-privilege accounts.
- Monitor for HTTP 200 responses on /issues/ requests originating from users outside the project's contributor list.
How to Mitigate CVE-2026-11441
Immediate Actions Required
- Upgrade OneDev to version 15.0.6 or later, available from the official GitHub release page.
- Audit recent issue and pull request access logs for unauthorized retrievals while planning the upgrade.
- Review OneDev user accounts and remove unnecessary low-privilege access until the patch is applied.
Patch Information
TheOneDev addressed CVE-2026-11441 in OneDev 15.0.6. The fix corrects authorization enforcement within the canAccessIssue function so that the Pull Request Handler validates the requester's permissions against the targeted issue before returning data. Administrators should follow the project's standard upgrade procedure and verify the deployed binary version after rollout.
Workarounds
- Restrict network access to the OneDev instance using reverse proxy access controls or VPN gating until the patch is deployed.
- Tighten project membership and role assignments to minimize the number of authenticated users who can reach the vulnerable endpoint.
- Disable or limit self-registration on the OneDev instance to reduce the pool of accounts capable of exploiting the flaw.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
