The vulnerability in REBUILD 4.5.0 is a missing authorization check in the TaskCommentController.commentList endpoint. The flaw allows authenticated users who do not belong to a project to read comments and attachment references for tasks in that project. This is a confidentiality breach, as the attacker can retrieve potentially sensitive discussion data from private projects, but it does not provide code execution or privilege escalation.

The affected product is REBUILD from getrebuild, version 4.5.0. Users running this build are exposed to the flaw.

The flaw scores 5.3 on the CVSS base metric and is not listed in the CISA KEV catalog. EPSS data is not available, so the overall exploitation likelihood remains uncertain but moderate. The attack vector is through the /project/comments/list HTTP endpoint and requires only a valid authenticated session of a low‑privileged user; no elevated privileges, network traversal, or code execution are required.