CVE-2026-31874
Gravedad CVSS v3.1:
CRÍTICA
Tipo:
CWE-284
Control de acceso incorrecto
Fecha de publicación:
11/03/2026
Última modificación:
11/03/2026
Descripción
*** Pendiente de traducción *** Taskosaur is an open source project management platform with conversational AI for task execution in-app. In 1.0.0, the application does not properly validate or restrict the role parameter during the user registration process. An attacker can manually modify the request payload and assign themselves elevated privileges. Because the backend does not enforce role assignment restrictions or ignore client-supplied role parameters, the server accepts the manipulated value and creates the account with SUPER_ADMIN privileges. This allows any unauthenticated attacker to register a fully privileged administrative account.
Impacto
Puntuación base 3.x
9.80
Gravedad 3.x
CRÍTICA