Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project by exploiting unprotected POST endpoints on the user-story, task, and issue due-date API viewsets. Attackers can supply an arbitrary project identifier to these endpoints, which bypass permission checks and apply the AllowAny default, to pre-empt project administrators from initializing due dates by creating records before they can do so themselves.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-01-27 | 1 | Patch1 |
| 2026-07-02 | 2 | Disclosure2 |
Warning: Multiple critical vulnerabilities in #dormakaba access manager #exos9300. #CVE-2025-59090 #CVE-2026-59097 #CVE-2026-59108 #CVE-2025-59103 CVSS: 9.3-9.2. See official advisories: https://www.dormakabagroup.com/en/security-advisories #Patch #Patch #Patch
Post summary
The tweet alerts about multiple critical CVEs affecting Dormakaba Exos 9300, provides CVSS scores, and points to official advisories for patches.
🚨*CVE* CVE-2026-59097 Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project by e… https://www.cve.org/CVERecord?id=CVE-2026-59097 ----- Traducción: CVE-2026-59097 Tai… http://infoflow.cloud`
Post summary
The text announces CVE-2026-59097, describing a missing authorization flaw allowing unauthenticated attackers to create default due‑date records in any project.
CVE-2026-59097 Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project by e… https://www.cve.org/CVERecord?id=CVE-2026-59097
Post summary
The text announces a missing authorization vulnerability in Taiga versions prior to 6.10.2, allowing unauthenticated remote attackers to create default due‑date records in any project.