CVE-2026-11438: OneDev Authorization Bypass in Project Forking – Patch Guidance

Technical summary

CVE-2026-11438 is an improper authorization vulnerability (CWE-266, CWE-285) in the OneDev /projects endpoint. The vulnerability exists in the project forking functionality, specifically in the handling of the project.forkedFromId parameter. An authenticated attacker can craft requests that manipulate this parameter to bypass authorization checks, potentially allowing them to fork projects from or to contexts where they lack explicit permission. The vulnerability is remotely exploitable and requires only valid authentication credentials. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) indicates network accessibility, low complexity, and impact across confidentiality, integrity, and availability.

Business impact

This vulnerability introduces risk of unauthorized project access and modification within OneDev instances. Depending on the sensitivity of projects stored in the system, attackers could gain visibility into private repositories, tamper with project configurations or code, or disrupt project availability. The impact is limited to authenticated users, reducing blast radius in environments with strong credential hygiene, but in shared or multi-tenant deployments, a compromised account could be leveraged to access or modify unrelated projects. For organizations using OneDev as a primary code repository platform, this represents a data confidentiality and integrity concern.

Affected systems

OneDev versions 15.0.5 and earlier are vulnerable. OneDev 15.0.6 and later versions have remediated this issue. The vulnerability does not appear on published vendor advisories as affecting downstream products, but any system running the affected OneDev versions in production is at risk.

Exploitability

The vulnerability is exploitable by any user with valid OneDev credentials. No additional privileges, special network positioning, or user interaction is required. The attack surface is the /projects endpoint, which is typically accessible to authenticated users within an organization. Exploitability is straightforward from a technical perspective, though the impact is restricted to the scope of projects the authenticated user can interact with under normal circumstances—meaning an attacker must first obtain or compromise a legitimate account.

Remediation

The primary remediation is to upgrade OneDev to version 15.0.6 or later. Organizations should prioritize this patch given the medium severity rating and the ease of exploitation by authenticated users. If immediate patching is not possible, review access controls and monitor for suspicious project forking activity.

Patch guidance

Upgrade to OneDev version 15.0.6 or a later release. Verify compatibility with your current deployment configuration before upgrading, particularly if you are running custom plugins or extensions. Test in a non-production environment first to confirm no regressions. The upgrade path from 15.0.5 to 15.0.6 should be straightforward; consult the OneDev release notes for any specific migration or configuration steps.

Detection guidance

Monitor /projects endpoint logs for unusual or high-volume forking requests, particularly those originating from service accounts or low-privilege users. Look for requests where the project.forkedFromId parameter values do not match the user's normal project scope. Track authentication logs for accounts that fork multiple projects in atypical patterns. If your OneDev instance logs API request payloads, inspect them for parameter manipulation attempts on project creation or forking operations. Baseline normal forking behavior for your organization to identify anomalies.

Why prioritize this

This vulnerability merits prompt attention because it combines remote network access, low attack complexity, and the need for only standard user authentication. While the CVSS score of 6.3 is medium, the authorization bypass nature and ease of exploitation make it worth prioritizing ahead of vulnerabilities with similar scores that require higher privileges or greater complexity. In multi-user environments, the risk compounds with each potential compromised or malicious account.

Risk score, explained

The CVSS 3.1 score of 6.3 (MEDIUM) reflects a vulnerability with network accessibility (AV:N) and low attack complexity (AC:L), but limited to authenticated users (PR:L). The impact is partial across confidentiality, integrity, and availability (C:L/I:L/A:L)—not total system compromise, but meaningful risk of data exposure and modification. The lack of scope change (S:U) means the vulnerability is confined to the affected component's security domain. The score appropriately captures a significant but not critical threat.

Frequently asked questions