CVE-2026-11441: theonedev onedev Authorization Bypass in Pull Request Handler

Technical summary

The vulnerability stems from improper authorization logic in the canAccessIssue function within the Pull Request Handler component (located at /issues/). The flaw allows an authenticated attacker to bypass authorization checks by manipulating the issue argument passed to this function. This represents a classic case of insecure direct object reference (IDOR) combined with weak access control validation. Because the pull request handler fails to properly verify whether the requesting user has permission to access a specific issue before returning data or allowing modifications, an attacker can enumerate or modify issues across the application. The vulnerability is remotely exploitable and requires only valid authentication—a low bar for exploitation in many environments.

Business impact

Compromise of project confidentiality and integrity across your onedev instance. Authenticated attackers can view issues they should not have access to, potentially exposing sensitive bug reports, security findings, roadmap details, or customer information embedded in issue descriptions and comments. Additionally, attackers could alter issue state, descriptions, or metadata to disrupt workflows or cover tracks. In development-heavy organizations, this can compromise intellectual property, delay release cycles through sabotage, and breach customer trust if sensitive customer-reported issues are exposed. The severity is heightened in multi-tenant or shared-project environments where issue access control is essential to data isolation.

Affected systems

theonedev onedev versions 15.0.5 and earlier are affected. Organizations running any deployment of onedev up to and including version 15.0.5 should assume exposure. This includes self-hosted instances across all operating systems and cloud deployments. The vulnerability affects the core pull request and issue handling functionality, meaning any onedev instance using pull requests is vulnerable.

Exploitability

Exploitation is low-friction. An attacker must possess valid credentials to the onedev instance, but no special privileges are required—any authenticated user can attempt the attack. The vulnerability does not require user interaction, complex timing, or multiple exploitation steps. The attack can be executed through direct API calls or by manipulating web requests, making it suitable for both manual and automated exploitation. However, exploitation is limited to attackers with legitimate access to the system, which provides some natural containment compared to unauthenticated flaws.

Remediation

Upgrade all affected onedev instances to version 15.0.6 or later. This version resolves the authorization bypass by implementing proper access control validation in the canAccessIssue function. There are no known workarounds for this vulnerability; patching is the only mitigation path. Organizations should prioritize this upgrade, particularly if their onedev instance contains multi-user or multi-project environments where data isolation is critical.

Patch guidance

1. Review your current onedev version via the administration dashboard or CLI. 2. Back up your onedev instance and database before patching. 3. Download and test onedev 15.0.6 in a non-production environment first to ensure compatibility with custom plugins or configurations. 4. Apply the upgrade following theonedev documentation for your deployment method (Docker, standalone, etc.). 5. Verify after upgrade that pull request and issue access controls function correctly and that users can only access issues within their assigned projects.

Detection guidance

Look for access patterns indicating unauthorized issue queries: (1) Users accessing issues outside their assigned projects in access logs or audit trails. (2) Repeated 200 OK responses to /issues/ requests with unusual or high-numbered issue IDs. (3) Users modifying issue descriptions, state, or metadata that they did not create or are not assigned to. (4) Spike in API calls to the pull request handler from a single authenticated user. Monitor onedev audit logs for 'issue accessed' or 'issue modified' events associated with users who lack project membership or issue assignment. Network monitoring can surface suspicious patterns if users repeatedly fetch issues across many projects in a short window.

Why prioritize this

Prioritize this as a near-term remediation target. While it requires authentication, the CVSS 6.3 (MEDIUM) score reflects meaningful impact across confidentiality, integrity, and availability. The vulnerability directly compromises data isolation in multi-project environments and is trivial to exploit once credentials are obtained. Organizations with shared development teams, customer-facing issue tracking, or sensitive roadmap information should patch urgently. Those in heavily regulated industries should treat this with higher urgency given the potential for unauthorized access to regulated data.

Risk score, explained

The CVSS 3.1 score of 6.3 (MEDIUM) reflects: (1) Network-accessible attack vector (AV:N), allowing remote exploitation without special network positioning. (2) Low attack complexity (AC:L), as no special conditions or timing are required. (3) Low privilege requirement (PR:L), indicating any authenticated user can attempt the exploit. (4) Low impact across confidentiality, integrity, and availability (C:L, I:L, A:L), meaning the flaw grants partial unauthorized access to project data and limited ability to modify or disrupt it. The score appropriately captures that this is a privilege-escalation flaw within a collaborative tool, not a system-wide compromise, but one that nonetheless erodes data isolation and should not be ignored.

Frequently asked questions