The flaw in Taiga before version 6.10.2 is a missing authorization check that allows any unauthenticated remote user to send POST requests to the user-story, task, and issue due-date API viewsets with an arbitrary project identifier. This bypasses normal permission checks and leverages the AllowAny default setting, enabling the attacker to create default due-date records in the targeted project. The resulting broken access control (CWE-862) can pre-empt project administrators by initializing due dates before they can do so, potentially disrupting project timelines and introducing unauthorized artifacts.

The taiga-back service of the Taiga project management platform is affected. Any installation running a version earlier than 6.10.2 that exposes the public user viewsets is vulnerable. Attackers can target any project within those installations by specifying a project identifier in the POST payload.

The CVSS score of 6.9 indicates a medium-to-high impact risk, and the EPSS score of <1% shows a low but non-zero exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an unauthenticated remote attacker who can reach the API endpoints and send a crafted POST request with a chosen project ID. No additional privileges or insider access are required, making the exploit practical when the endpoints are exposed on a network.