A manipulation of the project.defaultBranch argument in the default‑branch endpoint of theonedev’s REST API can bypass standard authorization checks, allowing an attacker to read or potentially modify information about the default branch of any project for which they are not authorized; this flaw is an authentication/authorization weakness that can lead to unauthorized access to repository metadata.

Theonedev Onedev versions up to and including 15.0.5 are affected; any deployment exposing the REST API endpoint /repositories/{projectId}/default-branch without proper access controls can be exploited.

The CVSS score of 5.3 indicates moderate impact, and no EPSS score is available, so current exploitation likelihood is unknown; the flaw is remotely exploitable via the REST API, requiring only network reachability to the server, and it is not currently listed in CISA KEV, though the absence of publicly known exploits does not reduce the risk of a custom or internal attack.