Auth bypass in Alanaktion Phproject
CVE-2026-104991
Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints (single_get, single_comments, single_comments_post) that allows authenticated API key holders to bypass the security.restrict_access confidentiality control by never invoking the allowAccess() authorization routine. Attackers can use a valid API key to read restricted issue contents and comments, including owner and author email addresses, and post unauthorized comments to issues they should not have access to.
Vulnerability class: Broken Access Control
Published .
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/Alanaktion/phproject/security/advisories/GHSA-mpq9-v47x-3hw8 (vendor-advisory, technical-description)
- github.com/Alanaktion/phproject/releases/tag/v1.8.7 (issue-tracking, vendor-advisory)
- www.vulncheck.com/advisories/phproject-missing-authorization-via-issues-rest-api (third-party-advisory)
Frequently asked questions
- What is CVE-2026-104991?
- CVE-2026-104991 is a high-severity vulnerability in Alanaktion Phproject, classified under Missing Authorization. CVSS score: 7.1/10. Published 2026-10-02.
- How severe is CVE-2026-104991?
- High severity. CVSS v3 base score is 7.1 out of 10.