Vulnerability Description
WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet that allows authenticated users to access other projects' tasks. Attackers can set project_pk to another project's sequential ID to modify, delete, or trigger scheduled tasks via run-now and read execution logs.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/MGdaasLab/WHartTest
- https://github.com/MGdaasLab/WHartTest/blob/v2.8.1/WHartTest_Django/task_center/
- https://github.com/MGdaasLab/WHartTest/blob/v2.8.1/WHartTest_Django/task_center/
- https://github.com/MGdaasLab/WHartTest/issues/166
- https://hackmd.io/@hieuPenguinnn/wharttest-scheduled-task-cross-project-missing-
- https://www.vulncheck.com/advisories/wharttest-2.2.0-through-2.8.1-missing-autho
FAQ
What is CVE-2026-119665?
CVE-2026-119665 is a vulnerability with a CVSS score of 6.3 (MEDIUM). WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet that allows authenticated users to access other projects' tasks. Attackers...
How severe is CVE-2026-119665?
CVE-2026-119665 has been rated MEDIUM with a CVSS base score of 6.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-119665?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.