Executive brief
OneDev, an open-source software development platform, contains a security flaw in its programming interface (API). This vulnerability allows users who only have permission to edit code to also change critical project settings, such as the default branch. This could allow an unauthorized user to disrupt automated workflows or change which version of the code is shown to others by default.
Technical details
An improper authorization vulnerability (CWE-285/CWE-266) exists in the OneDev REST API endpoint `/repositories/{projectId}/default-branch`. The root cause is an inconsistency between the Web UI and the REST API; while the UI requires project management permissions to change the default branch, the REST API only validates 'WriteCode' permissions. A remote attacker with authenticated access and code-write privileges can manipulate the 'project.defaultBranch' argument to change the default branch of a repository. This can impact workflow automation and branch selection logic. The issue is addressed in version 15.0.6.
Affected products
- theonedev OneDev up to 15.0.5
Timeline
- 2026-05-07: patched: Version 15.0.6 released
- 2026-05-08: disclosed: Vulnerability details published by researcher
- 2026-06-06: advisory: CVE-2026-11440 published