Executive brief
DevaslanPHP project-management is an open-source tool used for tracking tasks and project progress. A security flaw in the Kanban and Scrum board component allows a logged-in user to modify the status and order of tickets belonging to projects they do not have permission to access. This could lead to unauthorized changes in project workflows and data integrity issues across different teams or clients using the same system.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the `KanbanScrumHelper::recordUpdated` function within `app/Helpers/KanbanScrumHelper.php`. The function, which acts as a Livewire listener, accepts a ticket ID, a new index, and a new status directly from the client without verifying if the authenticated user has ownership of or membership in the project associated with the ticket. A remote attacker with low-level authenticated access can exploit this by sending crafted Livewire protocol requests to modify the status and ordering of any ticket in the database. As of the advisory date, the project maintainers have been notified but no official patch has been released.
Affected products
- DevaslanPHP project-management up to 2.0.0-beta1
Timeline
- 2026-03-04: disclosed: Issue reported to the developer via GitHub
- 2026-06-01: advisory: CVE published by VulDB/NVD