CVE-2026-59097 describes a missing authorization vulnerability in Taiga's backend (taiga-back) before version 6.10.2. The vulnerability arises because certain POST endpoints related to due-date management for user stories, tasks, and issues do not enforce proper permission checks. Instead, they apply an AllowAny default permission, allowing unauthenticated attackers to create due-date records in any project by supplying arbitrary project identifiers. This bypasses intended access controls and can disrupt project management workflows by pre-empting administrators' initialization of due dates.

The vulnerability allows unauthenticated remote attackers to create or modify due-date records in any project without authorization. While it does not disclose sensitive information or allow code execution, it impacts the integrity of project data by enabling attackers to interfere with due-date settings. This could cause confusion or disruption in project management processes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions prior to 6.10.2, upgrading to version 6.10.2 or later is recommended once an official fix is released. Until then, restrict access to the affected API endpoints or implement additional access controls to prevent unauthorized POST requests to due-date endpoints.