Description
A vulnerability has been found in DevaslanPHP project-management up to 2.0.0-beta1. Affected by this issue is the function KanbanScrumHelper::recordUpdated of the file app/Helpers/KanbanScrumHelper.php of the component Ticket Handler. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-06-01
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the KanbanScrumHelper::recordUpdated function within the Ticket Handler component of DevaslanPHP project-management. A remote attacker can manipulate the update process to bypass authorization checks, enabling unauthorized changes to ticket records. The resulting breach of data integrity can compromise the accuracy and reliability of the ticketing system, as the weakness maps to CWE-266 and CWE-285.

Affected Systems

All installations of the DevaslanPHP project-management component up to and including version 2.0.0-beta1 are affected. The project is maintained on GitHub and no official patch has been released to address the improper authorization flaw.

Risk and Exploitability

With a CVSS score of 5.3 the vulnerability is classified as medium severity. The EPSS score is unavailable, and the issue is not listed in the CISA KEV catalog, indicating lower publicized exploitation risk. The attack vector is remote, meaning that a threat actor could exploit the flaw over the network against users who can reach the Ticket Handler endpoints, especially if no additional access control safeguards are in place.

Generated by OpenCVE AI on June 1, 2026 at 21:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Restrict exposure of the Ticket Handler recordUpdated endpoint by implementing role‑based access checks so that only authorized users can invoke it.
  • Apply a local code patch that inserts an explicit authorization verification before performing the record update operation.
  • Monitor the DevaslanPHP project repository for an official fix and upgrade to a non‑vulnerable version as soon as one becomes available.

Generated by OpenCVE AI on June 1, 2026 at 21:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 02 Jun 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 01 Jun 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Devaslanphp project Management
Vendors & Products Devaslanphp project Management

Mon, 01 Jun 2026 20:30:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in DevaslanPHP project-management up to 2.0.0-beta1. Affected by this issue is the function KanbanScrumHelper::recordUpdated of the file app/Helpers/KanbanScrumHelper.php of the component Ticket Handler. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.
Title DevaslanPHP project-management Ticket KanbanScrumHelper.php recordUpdated improper authorization
First Time appeared Devaslanphp
Devaslanphp project-management
Weaknesses CWE-266
CWE-285
CPEs cpe:2.3:a:devaslanphp:project-management:*:*:*:*:*:*:*:*
Vendors & Products Devaslanphp
Devaslanphp project-management
References
Metrics cvssV2_0

{'score': 5.5, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:P/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Devaslanphp Project-management Project Management
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-06-02T12:22:08.130Z

Reserved: 2026-05-31T16:30:13.123Z

Link: CVE-2026-10285

cve-icon Vulnrichment

Updated: 2026-06-02T12:21:59.934Z

cve-icon NVD

Status : Deferred

Published: 2026-06-01T21:16:25.310

Modified: 2026-06-02T13:03:31.153

Link: CVE-2026-10285

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-01T22:00:12Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-285

    Improper Authorization