Executive brief
OneDev, an open-source software development platform, contains a security flaw in its issue-tracking system. This vulnerability allows users who have basic access to the system to view sensitive time-tracking and workload data that they are not authorized to see. This could lead to the exposure of team productivity metrics, work schedules, and internal operational details.
Technical details
An improper authorization vulnerability exists in OneDev versions up to 15.0.5 within the 'canAccessIssue' function of the Pull Request Handler component. The root cause is inconsistent authorization semantics between the REST API and the Web UI; specifically, the REST endpoints for '/issues/' validate only general issue access rather than checking for dedicated time-tracking permissions. A remote authenticated attacker can exploit this by querying the REST API to retrieve 'totalSpentTime', 'ownEstimatedTime', and detailed work-log entries ('issueWork') for issues they can see, bypassing intended visibility restrictions. This allows for the unauthorized collection of team workload distribution and operational metadata. The issue is resolved in version 15.0.6.
Affected products
- theonedev OneDev up to 15.0.5
Timeline
- 2026-05-07: patched: Version 15.0.6 released
- 2026-05-08: disclosed: Vulnerability details published by researcher
- 2026-06-06: advisory: NVD/VulDB advisory published