Executive brief
DevaslanPHP project-management is an open-source tool for managing software development tasks. A security flaw in the ticket viewing component allows logged-in users to edit or delete comments they do not own. This could lead to unauthorized data modification or loss of communication history within project tickets.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the Livewire Handler component of DevaslanPHP project-management. Specifically, the 'editComment' and 'doDeleteComment' functions in 'app/Filament/Resources/TicketResource/Pages/ViewTicket.php' accept comment IDs directly from the client without verifying if the authenticated user has the permission to modify that specific record. While the user interface hides these options from unauthorized users, the underlying Livewire methods remain reachable via direct network requests. An attacker with a standard user account can exploit this to delete or edit any comment across the platform. As of the advisory date, no official patch has been released.
Affected products
- DevaslanPHP project-management up to 2.0.0-beta1
Timeline
- 2026-02-28: disclosed: Issue reported to the project maintainer via GitHub
- 2026-06-01: advisory: CVE published by VulDB/NVD