The flaw in Taiga before version 6.10.2 is a missing authorization check that allows any unauthenticated remote user to send POST requests to the user‑story, task, and issue due‑date API viewsets with an arbitrary project identifier. This bypasses normal permission checks and leverages the AllowAny default setting, enabling the attacker to create default due‑date records in the targeted project. The resulting broken access control (CWE‑862) can pre‑empt project administrators by initializing due dates before they can do so, potentially disrupting project timelines and introducing unauthorized artifacts.

The taiga-back service of the Taiga project management platform is affected. Any installation running a version earlier than 6.10.2 that exposes the public user viewsets is vulnerable. Attackers can target any project within those installations by specifying a project identifier in the POST payload.

The CVSS score of 6.9 indicates a medium‑to‑high impact risk, and the EPSS score of <1% shows a low but non‑zero exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an unauthenticated remote attacker who can reach the API endpoints and send a crafted POST request with a chosen project ID. No additional privileges or insider access are required, making the exploit practical when the endpoints are exposed on a network.