Medium 5.3Published Jul 2, 2026

CVE-2026-59097Taiga < 6.10.2 - Unauthorized Due-Date Creation via API Viewsets

Updated under an hour ago (Oct 27, 2026, 3:10 PM ET)

Does this affect you?

It affects taiga-back. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for taiga-back

Exploited in the last 30 days

Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project by exploiting unprotected POST endpoints on the user-story, task, and issue due-date API viewsets. Attackers can supply an arbitrary project identifier to these endpoints, which bypass permission checks and apply the AllowAny default, to pre-empt project administrators from initializing due dates by creating records before they can do so themselves.

CVSS: 5.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness (CWE): CWE-862
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Jul 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

taiga taiga-back taiga:back (from the name)	before 6.10.2	CNA record

References

References

https://github.com/taigaio/taiga-back/releases/tag/6.10.2	release-notes
https://github.com/taigaio/taiga-back/issues/244	technical-description, exploit
https://github.com/taigaio/taiga-back/pull/245	issue-tracking
https://github.com/taigaio/taiga-back/commit/f925af424623350e04d4abc45bf1dc70e70c48a9	patch
https://www.vulncheck.com/advisories/taiga-unauthorized-due-date-creation-via-api-viewsets	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.