CVE-2026-31874 Taskosaur Improper Role Assignment via Parameter Manipulation in User Registration
An attacker can register a SUPER_ADMIN account by manipulating the role parameter during user registration, gaining full administrative control.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-31874?
CVE-2026-31874 is a critical vulnerability in Taskosaur, published on 11 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Taskosaur is an open source project management platform with conversational AI for task execution in-app. In 1.0.0, the application does not properly validate or restrict the role parameter during the user registration process. An attacker can manually modify the request payload and assign themselves elevated privileges. Because the backend does not enforce role assignment restrictions or ignore client-supplied role parameters, the server accepts the manipulated value and creates the account with SUPER_ADMIN privileges. This allows any unauthenticated attacker to register a fully privileged administrative account.
Which versions are affected by CVE-2026-31874?
It affects 1 product.
Products include Taskosaur Taskosaur.
How do I fix CVE-2026-31874?
No fix has been published for CVE-2026-31874 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-31874 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-31874 exists.
Sources
Also known as GHSA-r6gj-4663-p5mr.