[ CVE-2026-119665 · Published 30 Oct 2026 ]
Vulnerability in MGdaasLab WHartTest
CVSS 6.3
EPSS <1%No fix listed yet
[ Description ]Official description
WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet that allows authenticated users to access other projects' tasks. Attackers can set project_pk to another project's sequential ID to modify, delete, or trigger scheduled tasks via run-now and read execution logs.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ References ]References
- github.com/MGdaasLab/WHartTest
- github.com/MGdaasLab/WHartTest/blob/v2.8.1/WHartTest_Django/task_center/views.py
- github.com/MGdaasLab/WHartTest/blob/v2.8.1/WHartTest_Django/task_center/views.py
- github.com/MGdaasLab/WHartTest/issues/166
- hackmd.io/@hieuPenguinnn/wharttest-scheduled-task-cross-project-missing-authz-idor
- www.vulncheck.com/advisories/wharttest-2.2.0-through-2.8.1-missing-authorization-via-ta…