CVE-2026-59097 describes a missing authorization vulnerability in Taiga before version 6.10.2. The vulnerability exists in the taiga-back service where certain POST API endpoints related to due-date management for user stories, tasks, and issues do not enforce proper permission checks. Instead, these endpoints apply an AllowAny default, enabling unauthenticated remote attackers to create due-date records in any project by supplying arbitrary project identifiers. This bypasses intended authorization controls and can disrupt project management workflows.

The vulnerability allows unauthenticated attackers to create or pre-empt due-date records in projects they do not have access to. While it does not disclose sensitive data or allow direct modification of existing data, it impacts the integrity of project scheduling by allowing unauthorized insertion of due dates. There is no impact on confidentiality or availability reported. The CVSS score of 5.3 reflects a medium severity with low attack complexity and no privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions prior to 6.10.2, upgrading to version 6.10.2 or later is recommended once a fix is available. Until then, restrict access to the affected API endpoints if possible or implement additional access controls to prevent unauthenticated POST requests to due-date endpoints.