The vulnerability is present in theonedev onedev up to version 15.0.5 and arises from the manipulation of the project.forkedFromId argument in the /projects endpoint. This flaw results in improper authorization, which means that an attacker can bypass the standard access controls for certain project-related operations. Based on the description, it is inferred that the attacker could potentially read, modify or delete project data that should otherwise be restricted.

Vendors affected are Theonedev with the Onedev product. All installations running version 15.0.5 or earlier are vulnerable. The update to version 15.0.6 addresses the issue; no other affected versions are listed.

The CVSS score of 5.3 indicates a moderate severity. EPSS information is not available and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw remotely by sending crafted requests to the /projects endpoint that manipulate the project.forkedFromId parameter. Because the influence on authorization is lost, the potential for data exposure or modification exists, but the exact extent depends on the application’s role and permissions model. Overall risk is considered moderate due to the remote nature and the lack of clear prerequisites.