# CVE-2026-10285: DevaslanPHP project-management improper authorization in KanbanScrumHelper

Source: https://junglewise.ai/threats/cve-2026-10285-devaslanphp-project-management-improper-authorization-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-10285 · Severity: medium · CVSS 5.4 · Published 2026-06-01

DevaslanPHP project-management is an open-source tool used for tracking tasks and project progress. A security flaw in the Kanban and Scrum board component allows a logged-in user to modify the status and order of tickets belonging to projects they do not have permission to access. This could lead to unauthorized changes in project workflows and data integrity issues across different teams or clients using the same system.

Technologies: [DevaslanPHP Project-Management](https://junglewise.ai/threats/technologies/project-management). Vendors: [DevaslanPHP](https://junglewise.ai/threats/vendors/devaslanphp).

## Quick answers

**Is CVE-2026-10285 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10285 being exploited in the wild.

**How severe is CVE-2026-10285?** Medium severity, with a CVSS score of 5.4, published 1 June 2026.

**Which products and versions are affected?** DevaslanPHP Project-Management up to 2.0.0-beta1.

**Is there a fix for CVE-2026-10285?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10285 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-10285?** Check whether you run DevaslanPHP Project-Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the `KanbanScrumHelper::recordUpdated` function within `app/Helpers/KanbanScrumHelper.php`. The function, which acts as a Livewire listener, accepts a ticket ID, a new index, and a new status directly from the client without verifying if the authenticated user has ownership of or membership in the project associated with the ticket. A remote attacker with low-level authenticated access can exploit this by sending crafted Livewire protocol requests to modify the status and ordering of any ticket in the database. As of the advisory date, the project maintainers have been notified but no official patch has been released.

## Affected products

- DevaslanPHP project-management up to 2.0.0-beta1

## Timeline

- 2026-03-04: disclosed: Issue reported to the developer via GitHub
- 2026-06-01: advisory: CVE published by VulDB/NVD

## References

- [https://github.com/devaslanphp/project-management/](https://github.com/devaslanphp/project-management/)
- [https://github.com/devaslanphp/project-management/issues/141](https://github.com/devaslanphp/project-management/issues/141)
- [https://vuldb.com/cve/CVE-2026-10285](https://vuldb.com/cve/CVE-2026-10285)
- [https://vuldb.com/submit/825475](https://vuldb.com/submit/825475)
- [https://vuldb.com/vuln/367578](https://vuldb.com/vuln/367578)
- [https://vuldb.com/vuln/367578/cti](https://vuldb.com/vuln/367578/cti)

## Related threats

- [DevaslanPHP project-management server-side request forgery in Jira Import](https://junglewise.ai/threats/cve-2026-100900-a-vulnerability-has-been-found-in-devaslanphp-project-management)
- [DevaslanPHP project-management SQL injection in Timesheet Dashboard](https://junglewise.ai/threats/cve-2026-100899-a-flaw-has-been-found-in-devaslanphp-project-management-1-2-1-1)
- [DevaslanPHP project-management SQL injection in Timesheet Dashboard](https://junglewise.ai/threats/cve-2026-100898-a-vulnerability-was-detected-in-devaslanphp-project-management-1)
- [DevaslanPHP project-management improper authorization in ticket comments](https://junglewise.ai/threats/cve-2026-10284-devaslanphp-project-management-improper-authorization-in-ticket)