Is CVE-2026-11440 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11440 being exploited in the wild.

How severe is CVE-2026-11440?

Medium severity, with a CVSS score of 6.3, published 6 June 2026.

Is there a fix for CVE-2026-11440?

A patch was published on 2026-05-07: Version 15.0.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-11440 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-11440?

Check whether you run OneDev at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11440: theonedev OneDev improper authorization in REST API default-branch endpoint

CVE-2026-11440 · Severity: medium · CVSS 6.3 · Published 2026-06-06

OneDev, an open-source software development platform, contains a security flaw in its programming interface (API). This vulnerability allows users who only have permission to edit code to also change critical project settings, such as the default branch. This could allow an unauthorized user to disrupt automated workflows or change which version of the code is shown to others by default.

Technologies: OneDev. Vendors: OneDev.

Quick answers

Is CVE-2026-11440 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11440 being exploited in the wild.
How severe is CVE-2026-11440?: Medium severity, with a CVSS score of 6.3, published 6 June 2026.
Which products and versions are affected?: OneDev up to 15.0.5.
Is there a fix for CVE-2026-11440?: A patch was published on 2026-05-07: Version 15.0.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11440 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-11440?: Check whether you run OneDev at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper authorization vulnerability (CWE-285/CWE-266) exists in the OneDev REST API endpoint `/repositories/{projectId}/default-branch`. The root cause is an inconsistency between the Web UI and the REST API; while the UI requires project management permissions to change the default branch, the REST API only validates 'WriteCode' permissions. A remote attacker with authenticated access and code-write privileges can manipulate the 'project.defaultBranch' argument to change the default branch of a repository. This can impact workflow automation and branch selection logic. The issue is addressed in version 15.0.6.

Affected products

theonedev OneDev up to 15.0.5

Timeline

2026-05-07: patched: Version 15.0.6 released
2026-05-08: disclosed: Vulnerability details published by researcher
2026-06-06: advisory: CVE-2026-11440 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.