Executive brief
OneDev, an open-source software development platform, contains a vulnerability that allows users to move projects into namespaces where they do not have permission to create content. By manipulating project settings, an attacker can bypass security boundaries to alter the project hierarchy and inheritance rules. This could lead to unauthorized access to projects or the disruption of organizational permission structures.
Technical details
An improper authorization vulnerability exists in OneDev's Parent Project Handler component within the /projects/ endpoint. The root cause is a logic error where the application overwrites the existing parent relationship before performing permission checks, causing the system to compare the new parent ID against itself rather than validating if the user has 'CreateChildren' permissions in the target namespace. A remote attacker with low-level project management privileges can exploit this by sending a crafted POST request to modify the 'project.parentId' attribute. This allows the attacker to rebind projects to unauthorized parent namespaces, potentially altering inherited settings and permission propagation chains. The issue is resolved in version 15.0.6.
Affected products
- theonedev OneDev up to 15.0.5
Timeline
- 2026-05-08: disclosed: Initial vulnerability report by Aibot
- 2026-05-07: patched: Version 15.0.6 released
- 2026-06-06: advisory: CVE-2026-11439 published