SZB-c30523bb9b
EUVD-2026-114081 reports missing authorization flaw in WHartTest
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- MGdaasLab
- Product
- WHartTest
- First seen
Summary
The EUVD advisory states that WHartTest 2.2.0 through 2.8.1 has a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet that lets authenticated users access other projects' tasks. The advisory describes setting project_pk to another project's sequential ID, which is a reported attack method.
If you use MGdaasLab
Upgrade WHartTest to a version later than 2.8.1 once a fixed release is available
Restrict user accounts to trusted users until patched
Review scheduled task and execution records for cross-project access
What the sources say 1
· Mastodon: “WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet that allows authenticated users to access other projects' tasks.” Source