# CVE-2026-111667: REBUILD authorization bypass in task comment listing

Source: https://junglewise.ai/threats/cve-2026-111667-rebuild-through-4-5-0-contains-a-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-111667 · Severity: medium · CVSS 4.3 · Published 2026-10-16

REBUILD is a low-code business platform that allows organizations to manage projects and tasks. The vulnerability allows any authenticated user to read comments and attachments from tasks in private projects they do not have access to, simply by knowing the task ID. An attacker can extract sensitive project information, conversations, and documents belonging to other teams or organizations.

Technologies: [REBUILD](https://junglewise.ai/threats/technologies/rebuild). Vendors: [REBUILD](https://junglewise.ai/threats/vendors/rebuild).

## Quick answers

**Is CVE-2026-111667 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111667 being exploited in the wild.

**How severe is CVE-2026-111667?** Medium severity, with a CVSS score of 4.3, published 16 October 2026.

**Which products and versions are affected?** REBUILD through 4.5.0.

**Is there a fix for CVE-2026-111667?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-111667 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-111667?** Check whether you run REBUILD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The TaskCommentController.commentList endpoint queries task comments using createQueryNoFilter, which bypasses the platform's row-level privilege checks, and never verifies the user has permission to read the target task. The ProjectHelper.isManageable() call returns only a boolean flag for UI rendering and is not used as an access gate, allowing comment content and attachments to be returned to unauthorized users. An authenticated attacker needs only the task ID from any private project to retrieve all associated comments and attachment metadata.

## Affected products

- REBUILD REBUILD through 4.5.0

## Timeline

- 2026-10-16: disclosed

## References

- [https://github.com/getrebuild/rebuild/blob/4.5.0/src/main/java/com/rebuild/web/project/TaskCommentController.java](https://github.com/getrebuild/rebuild/blob/4.5.0/src/main/java/com/rebuild/web/project/TaskCommentController.java)
- [https://hackmd.io/@hieuPenguinnn/getrebuild-rebuild-project-task-comment-idor](https://hackmd.io/@hieuPenguinnn/getrebuild-rebuild-project-task-comment-idor)

## Related threats

- [REBUILD authorization bypass in FeedsListController](https://junglewise.ai/threats/cve-2026-125372-rebuild-before-4-5-3-contains-an-authorization-bypass)
- [REBUILD authorization bypass in AiBot2Controller](https://junglewise.ai/threats/cve-2026-110611-rebuild-through-4-5-0-contains-an-authorization-bypass)
- [REBUILD announcement preview stored XSS via HTML entity decoding](https://junglewise.ai/threats/cve-2026-71802-rebuild-announcement-preview-stored-xss-via-html-entity-decoding)