CVE-2026-111667: Authorization Bypass Through User-Controlled Key in getrebuild rebuild
Description
REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id of a task in a private project to the /project/comments/list endpoint to retrieve its comment content and attachment references.
CVSS v4.0
Score 5.3medium
Affected software
getrebuild
rebuild
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in rebuild (up to version 4.5.0) involves a missing authorization check in the TaskCommentController.commentList method. This flaw permits authenticated users with limited privileges to bypass project membership restrictions and retrieve comments and attachment references from tasks in private projects by providing the task ID to the /project/comments/list endpoint. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no user interaction, and low impact on confidentiality.
Potential Impact
Authenticated low-privileged users can access sensitive comment content and attachment references from tasks in private projects without proper authorization. This could lead to unauthorized disclosure of project information. There is no indication of privilege escalation, integrity, or availability impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /project/comments/list endpoint to authorized project members only, if possible, and monitor for suspicious access patterns related to task comment retrieval.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-16T14:31:17.184Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad264132cdf04f656199590
Added to database: 10/16/2026, 17:51:15 UTC
Last enriched: 10/16/2026, 18:33:45 UTC
Last updated: 10/16/2026, 19:04:10 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.