CVE-2026-104991

Name of the Vulnerable Software and Affected Versions Phproject versions prior to 1.8.7

Description An issue exists in the REST API where object-level authorization is missing. Authenticated users with a valid API key can bypass the security.restrict access confidentiality control because the allowAccess() authorization routine is not invoked. This allows attackers to read restricted issue contents and comments, including owner and author email addresses, and post unauthorized comments to issues they should not have access to via the following endpoints: 'single get', 'single comments', and 'single comments post'.

Recommendations Update Phproject to version 1.8.7 or later.