CVE-2026-11439: OneDev Project Authorization Bypass (Version 15.0.5)

Technical summary

CVE-2026-11439 is an improper authorization vulnerability affecting OneDev's Parent Project Handler component. The flaw exists in the /projects/ endpoint where the project.parentId argument is not properly validated against the authenticated user's permissions. The vulnerability is rooted in insufficient authorization logic (CWE-285) combined with improper privilege assignment (CWE-266), allowing an authenticated attacker to traverse or modify project hierarchies they should not have access to. The attack is unauthenticated from a network perspective (CVSS AV:N) but requires a valid user session (PR:L), making it accessible to any authenticated user of the OneDev instance.

Business impact

Organizations running OneDev depend on project isolation and role-based access controls to manage sensitive code repositories and build pipelines. This vulnerability undermines those protections by allowing a junior developer, contractor, or compromised low-privilege account to view, modify, or disrupt projects outside their designated scope. In a multi-tenant or multi-team environment, this could lead to unauthorized code exposure, CI/CD tampering, or lateral movement to higher-value projects. The impact is magnified in compliance-heavy industries where audit trails and access segregation are critical.

Affected systems

OneDev versions up to and including 15.0.5 are vulnerable. Version 15.0.6 and later contain the fix. Any deployment using an affected version with multiple users or projects is at risk. Self-hosted and cloud-hosted OneDev instances are equally vulnerable if not patched.

Exploitability

Exploitation requires valid OneDev user credentials, which reduces opportunistic attack likelihood but increases insider-threat risk. Once authenticated, the attack is trivial—an attacker simply needs to craft a request with a modified project.parentId value pointing to a project they should not access. The low complexity (AC:L) and straightforward nature of parameter manipulation make this exploitable by attackers with basic web application knowledge. There is no known public exploit kit, and the vulnerability is not tracked in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Immediately upgrade OneDev to version 15.0.6 or later. This is a straightforward patching scenario with no known breaking changes. Organizations unable to patch immediately should restrict network access to OneDev to a trusted subset of users and audit recent project access logs for signs of unauthorized navigation.

Patch guidance

Visit the OneDev release notes and download version 15.0.6 or the latest available release from the official repository. Standard upgrade procedures apply: back up your OneDev instance (including the database), perform the upgrade, and verify that all projects and users are accessible post-upgrade. If you are running a managed or cloud-hosted OneDev service, check with your provider for patch availability and timeline. Verify the fix by testing that non-authorized users can no longer access projects via parent ID manipulation.

Detection guidance

Monitor OneDev request logs for unusual activity in the /projects/ endpoint, particularly POST or PUT requests from low-privilege users targeting projects outside their expected scope. Watch for repeated parent project modifications, especially those targeting high-sensitivity projects. Correlate API logs with user account activity to identify compromised or malicious sessions. Implement logging around project hierarchy changes and alert when a user accesses or modifies a project they have not previously worked with.

Why prioritize this

Although the CVSS score is medium (6.3), the risk should be weighted higher in organizations with strict data segregation requirements. The vulnerability is trivial to exploit once an attacker has any valid account, making it a natural stepping stone for privilege escalation or lateral movement. If your OneDev instance hosts security-sensitive, proprietary, or regulated code, prioritize patching within your next maintenance window.

Risk score, explained

The CVSS 3.1 score of 6.3 (MEDIUM) reflects the requirement for prior authentication (PR:L), which prevents unauthenticated remote exploitation. However, all three impact categories are affected—confidentiality (data exposure), integrity (project modification), and availability (potential disruption)—earning a score above 5.0. The network accessibility (AV:N) and low attack complexity (AC:L) prevent a lower rating. Organizations with strict role-based access controls and compliance requirements should consider this a high-priority fix despite the medium score.

Frequently asked questions