CVE-2026-59097: Taiga Taiga-Back

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project by exploiting unprotected POST endpoints on the user-story, task, and issue due-date API viewsets. Attackers can supply an arbitrary project identifier to these endpoints, which bypass permission checks and apply the AllowAny default, to pre-empt project administrators from initializing due dates by creating records before they can do so themselves.

Affected products

• Taiga Taiga-Back: before 6.10.2 (fixed in 6.10.2)

Published 2026-07-02. Last modified 2026-07-14.