[ CVE-2026-104991 · Published 2 Oct 2026 ]
Vulnerability in Alanaktion phproject
CVSS 7.1
EPSS <1%No fix listed yet
[ Why it matters ]Priority signals
- Public proof-of-concept exploit exists (CISA SSVC)
[ Description ]Official description
Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints (single_get, single_comments, single_comments_post) that allows authenticated API key holders to bypass the security.restrict_access confidentiality control by never invoking the allowAccess() authorization routine. Attackers can use a valid API key to read restricted issue contents and comments, including owner and author email addresses, and post unauthorized comments to issues they should not have access to.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.