Theonedev onedev versions up to 15.0.5 contain a flaw that allows an attacker to manipulate the project.parentId parameter through the Parent Project Handler, enabling improper authorization. This flaw permits users without appropriate privileges to alter project relationships or view and edit projects they should not access, thereby compromising the confidentiality and integrity of project data. The weakness originates from insufficient privilege checks, as categorized by CWE‑266 and CWE‑285.

The vulnerability affects theonedev onedev software, specifically all releases up to and including version 15.0.5. Any deployment using these versions is at risk.

The CVSS score of 5.3 denotes moderate severity, yet the vulnerability can be exploited remotely. The EPSS score is unavailable, and the issue is not listed in the CISA KEV catalog, indicating that while exploitation is possible, it may not be widely used in the wild. Attackers would need network access to the onedev instance and could manipulate the project.parentId parameter to gain unauthorized access or modify project relationships without owning proper permissions.