Is CVE-2026-11439 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11439 being exploited in the wild.

How severe is CVE-2026-11439?

Medium severity, with a CVSS score of 6.3, published 6 June 2026.

Is there a fix for CVE-2026-11439?

A patch was published on 2026-05-07: Version 15.0.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-11439 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-11439?

Check whether you run OneDev at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11439: theonedev OneDev improper authorization in Parent Project Handler

CVE-2026-11439 · Severity: medium · CVSS 6.3 · Published 2026-06-06

OneDev, an open-source software development platform, contains a vulnerability that allows users to move projects into namespaces where they do not have permission to create content. By manipulating project settings, an attacker can bypass security boundaries to alter the project hierarchy and inheritance rules. This could lead to unauthorized access to projects or the disruption of organizational permission structures.

Technologies: OneDev. Vendors: OneDev.

Quick answers

Is CVE-2026-11439 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11439 being exploited in the wild.
How severe is CVE-2026-11439?: Medium severity, with a CVSS score of 6.3, published 6 June 2026.
Which products and versions are affected?: OneDev up to 15.0.5.
Is there a fix for CVE-2026-11439?: A patch was published on 2026-05-07: Version 15.0.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11439 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-11439?: Check whether you run OneDev at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper authorization vulnerability exists in OneDev's Parent Project Handler component within the /projects/ endpoint. The root cause is a logic error where the application overwrites the existing parent relationship before performing permission checks, causing the system to compare the new parent ID against itself rather than validating if the user has 'CreateChildren' permissions in the target namespace. A remote attacker with low-level project management privileges can exploit this by sending a crafted POST request to modify the 'project.parentId' attribute. This allows the attacker to rebind projects to unauthorized parent namespaces, potentially altering inherited settings and permission propagation chains. The issue is resolved in version 15.0.6.

Affected products

theonedev OneDev up to 15.0.5

Timeline

2026-05-08: disclosed: Initial vulnerability report by Aibot
2026-05-07: patched: Version 15.0.6 released
2026-06-06: advisory: CVE-2026-11439 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.