CVE-2026-11440: OneDev Authorization Bypass in Default Branch API Endpoint

Technical summary

CVE-2026-11440 is an improper authorization flaw in the OneDev REST API endpoint `/repositories/{projectId}/default-branch`. The vulnerability stems from insufficient authorization checks on the `project.defaultBranch` parameter manipulation. Classified under CWE-266 (Improper Privilege Management) and CWE-285 (Improper Authorization), the flaw allows authenticated users to perform actions beyond their intended permissions. The CVSS 3.1 score of 6.3 reflects a network-accessible attack vector with low complexity, requiring only low-level privileges (authenticated session), affecting confidentiality, integrity, and availability equally.

Business impact

Exploitation could allow junior developers, read-only users, or other restricted account holders to reconfigure critical repository settings, such as changing the default branch. This could disrupt CI/CD pipelines, cause code merges to unexpected branches, or enable unauthorized code promotion to production. Organizations relying on branch-based access controls to enforce separation of duties face compromised security boundaries. The impact is amplified in teams where branch protection rules depend on accurate role-based authorization.

Affected systems

OneDev versions 15.0.5 and earlier are affected. The vulnerability specifically impacts instances with the REST API enabled and users holding any level of authenticated access. Organizations running older versions of OneDev should assume exposure. Upgrading to version 15.0.6 or later mitigates the issue.

Exploitability

This vulnerability requires low barriers to exploitation: an attacker must have valid login credentials (low privilege level sufficient) and network access to the OneDev instance. The attack is straightforward—a direct API call with modified parameters—and requires no user interaction or special conditions. No CISA KEV listing indicates active in-the-wild exploitation as of the publication date, but the simplicity of the attack and common organizational exposure to insider threats make this a credible risk requiring prompt remediation.

Remediation

Upgrade OneDev to version 15.0.6 or later. This version includes authorization fixes for the `/repositories/{projectId}/default-branch` endpoint. Organizations should also conduct a brief audit of recent branch configuration changes in the logs to detect any unauthorized modifications made while running vulnerable versions.

Patch guidance

Apply the OneDev 15.0.6 security update as soon as feasible. Verify the patch has been applied by checking the OneDev version in the administration interface. If you cannot upgrade immediately due to operational constraints, restrict API access to trusted networks or disable the affected endpoint where possible. Test the patch in a staging environment first to ensure compatibility with existing automation or integrations that may depend on this API.

Detection guidance

Monitor OneDev API logs and audit trails for unusual calls to `/repositories/{projectId}/default-branch`, particularly from low-privilege accounts or unexpected sources. Check git logs for unexpected default branch changes. Search authentication logs for accounts performing repository configuration changes outside normal patterns. SIEM rules should flag modification requests to this endpoint coming from users lacking repository admin roles.

Why prioritize this

Although rated CVSS 6.3 (MEDIUM), this vulnerability should be prioritized for rapid patching because: (1) it requires only basic authentication, lowering the attacker cost; (2) default branch manipulation can silently compromise code integrity; (3) it directly weakens access control boundaries that many teams rely on; and (4) the attack is trivial to execute once credentials are obtained, making it attractive for both insider threats and compromised accounts.

Risk score, explained

The CVSS 6.3 MEDIUM score reflects the authentication requirement (PR:L) and equal impact across confidentiality, integrity, and availability (C:L/I:L/A:L). However, the actual organizational risk may be higher if OneDev is used in environments with strong insider threat concerns, mandatory branch protection workflows, or environments where repository configuration is critical to compliance. The score does not capture the business context of code integrity and deployment pipeline security.

Frequently asked questions