Auth bypass in Taskosaur
CVE-2026-31874
Taskosaur is an open source project management platform with conversational AI for task execution in-app. In 1.0.0, the application does not properly validate or restrict the role parameter during the user registration process. An attacker can manually modify the request payload and assign themselves elevated privileges. Because the backend does not enforce role assignment restrictions or ignore client-supplied role parameters, the server accepts the manipulated value and creates the account with SUPER_ADMIN privileges. This allows any unauthenticated attacker to register a fully privileged administrative account.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.007 (50.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 50th percentile — 50.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.007 · change: +0.000
Affected products
- Taskosaur — versions 1.0.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-31874?
- CVE-2026-31874 is a critical-severity vulnerability in Taskosaur, classified under Improper Access Control. CVSS score: 9.8/10. Published 2026-03-11.
- How severe is CVE-2026-31874?
- Critical severity. CVSS v3 base score is 9.8 out of 10.