CVE-2026-11441: medium-severity vulnerability in theonedev onedev
theonedev Pull Request issues canAccessIssue improper authorization
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.2%
A vulnerability was identified in theonedev onedev up to 15.0.5. This vulnerability affects the function canAccessIssue of the file /issues/ of the component Pull Request Handler. Such manipulation of the argument issue leads to improper authorization. It is possible to launch the attack remotely. Upgrading to version 15.0.6 is able to resolve this issue. It is advisable to upgrade the affected component.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
Affected products
theonedev · onedevRelated CVEs — theonedev onedev
In the same product, most dangerous first.
CVE-2021-21242CRITICALPre-Auth Unsafe Deserialization on AttachmentUploadServetEPSS 74.2%CVE-2021-21243CRITICALPre-Auth Unsafe Deserialization on KubernetesResourceEPSS 54.5%CVE-2021-21246HIGHPre-Auth Access token leakEPSS 49.1%CVE-2024-45309HIGHOneDev vulnerable to arbitrary file reading for unauthenticated userEPSS 24.5%CVE-2021-21251HIGHZipSlip Arbitrary File UploadEPSS 12.7%CVE-2021-21249CRITICALPost-Auth Unsafe Yaml deserializationEPSS 3.1%