Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Taskosaur is an open source project management platform with conversational AI for task execution in-app. In 1.0.0, the application does not properly validate or restrict the role parameter during the user registration process. An attacker can manually modify the request payload and assign themselves elevated privileges. Because the backend does not enforce role assignment restrictions or ignore client-supplied role parameters, the server accepts the manipulated value and creates the account with SUPER_ADMIN privileges. This allows any unauthenticated attacker to register a fully privileged administrative account.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-03-11 | 3 | Disclosure2False Positive1 |
| 2026-03-12 | 1 | General1 |
CVE-2026-31874 Taskosaur is an open source project management platform with conversational AI for task execution in-app. In 1.0.0, the application does not properly validate or rest… https://www.cve.org/CVERecord?id=CVE-2026-31874
Post summary
The CVE is cited for Taskosaur 1.0.0 with an incomplete mention of a validation issue, but no exploitation details, patches, or active misuse are reported.
[CVE-2026-31874: CRITICAL] Taskosaur has a security vulnerability in version 1.0.0 allowing attackers to gain SUPER_ADMIN privileges during registration due to improper validation of role parameters.#cve,CVE-2026-31874,#cybersecurity https://cvefind.com/CVE-2026-31874
Post summary
The post discloses a critical privilege‑escalation flaw in Taskosaur v1.0.0, enabling attackers to obtain SUPER_ADMIN rights via registration, but offers no PoC, exploit, or remediation details.
🔴 CVE-2026-31874 - Critical Taskosaur is an open source project management platform with conversational AI for task execution in-app. In 1.0.0, the application does not properly validate or restrict the role paramet... https://www.thehackerwire.com/vulnerability/CVE-2026-31874/ https://t.co/SqjEDiibuR
Post summary
The tweet announces CVE‑2026‑31874 as a critical flaw in Taskosaur 1.0.0 that fails to properly validate or restrict the role parameter, with a reference to an external article for further detail.
🚨 CVE-2026-31874: Taskosaur Improper Role Assignme... Trusting client-side role parameters in registration? That's not a bug, that's a feature request for every script kiddi... https://zerodaysignal.com/vulnerability/CVE-2026-31874 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post challenges the existence of CVE-2026-31874, labeling it a false positive with no supporting technical details, PoC, exploitation evidence, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | taskosaur | taskosaur | 1.0.0 | node.js | - |