# CVE-2026-11438: theonedev OneDev improper authorization in project fork functionality

Source: https://junglewise.ai/threats/cve-2026-11438-theonedev-onedev-improper-authorization-in-project-fork  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-06. Updated: 2026-06-06  
License: CC BY 4.0 with a link back

CVE-2026-11438 · Severity: medium · CVSS 6.3 · Published 2026-06-06

OneDev, an open-source software development platform, contains a security flaw that allows users to bypass access controls when creating new projects. By manipulating project settings during creation, an authorized user can force the system to copy data from private repositories they are not supposed to see. This could lead to the unauthorized exposure of sensitive source code, project metadata, and internal development assets.

Technologies: [OneDev](https://junglewise.ai/threats/technologies/onedev). Vendors: [OneDev](https://junglewise.ai/threats/vendors/onedev).

## Quick answers

**Is CVE-2026-11438 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11438 being exploited in the wild.

**How severe is CVE-2026-11438?** Medium severity, with a CVSS score of 6.3, published 6 June 2026.

**Which products and versions are affected?** OneDev up to 15.0.5.

**Is there a fix for CVE-2026-11438?** A patch was published on 2026-05-07: Version 15.0.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-11438 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-11438?** Check whether you run OneDev at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper authorization vulnerability exists in OneDev's project creation workflow via the '/projects' endpoint. The application fails to validate if the requesting user has read permissions for the source project specified in the 'project.forkedFromId' argument. An attacker with project creation privileges can provide the ID of a private repository they cannot normally access; the system will then clone the repository data, LFS objects, and metadata into a new project owned by the attacker. Because the attacker is granted Owner-level permissions on the resulting fork, they can then read the copied contents. This issue is resolved in version 15.0.6.

## Affected products

- theonedev OneDev up to 15.0.5

## Timeline

- 2026-05-07: patched: Version 15.0.6 released
- 2026-05-08: disclosed: Vulnerability details published by researcher
- 2026-06-06: advisory: CVE-2026-11438 published

## References

- [https://github.com/theonedev/onedev/releases/tag/v15.0.6](https://github.com/theonedev/onedev/releases/tag/v15.0.6)
- [https://vuldb.com/cve/CVE-2026-11438](https://vuldb.com/cve/CVE-2026-11438)
- [https://vuldb.com/submit/822944](https://vuldb.com/submit/822944)
- [https://vuldb.com/vuln/369018](https://vuldb.com/vuln/369018)
- [https://vuldb.com/vuln/369018/cti](https://vuldb.com/vuln/369018/cti)
- [https://www.cnblogs.com/aibot/p/19994142](https://www.cnblogs.com/aibot/p/19994142)

## Related threats

- [OneDev arbitrary file write via absolute path symlink in TarUtils](https://junglewise.ai/threats/cve-2026-49248-onedev-arbitrary-file-write-via-absolute-path-symlink-in-tarutils)
- [theonedev OneDev improper authorization in Pull Request Handler](https://junglewise.ai/threats/cve-2026-11441-theonedev-onedev-improper-authorization-in-pull-request-handler)
- [theonedev OneDev improper authorization in REST API default-branch endpoint](https://junglewise.ai/threats/cve-2026-11440-theonedev-onedev-improper-authorization-in-rest-api-default)
- [theonedev OneDev improper authorization in Parent Project Handler](https://junglewise.ai/threats/cve-2026-11439-theonedev-onedev-improper-authorization-in-parent-project-handler)
- [OneDev path traversal in Git LFS pointer resolution](https://junglewise.ai/threats/cve-2026-44647-onedev-path-traversal-in-git-lfs-pointer-resolution)