Taiga 6.10.1 contains a missing authorization flaw that lets attackers make unauthenticated requests to the filters_data endpoints of UserStory, Task, Issue, and Epic viewsets. By supplying a project ID, a malicious actor can receive the full member roster and internal workflow configuration of any private project, exposing user identifiers, names, and gravatar hashes.

The vulnerability impacts the Taiga:taiga-back product. No specific affected version ranges are listed, but the issue is present in at least version 6.10.1.

The CVSS score of 6.9 indicates medium overall risk. With an EPSS score of less than 1% and no listing in the CISA KEV catalog, the likelihood of exploitation is presently low, but the disclosure of private project membership is still significant. Attackers can easily enumerate project IDs and obtain sensitive member data through simple unauthenticated GET requests to the filters_data endpoints, which bypass the normal access controls that protect other project APIs.