CVE-2026-67548

Name of the Vulnerable Software and Affected Versions taOS versions prior to 1.0.0-beta.25

Description The system registers all system settings routes under a single APIRouter() instance that lacks an admin authorization dependency. This allows any authenticated user, regardless of whether their is admin flag is set to False, to read and overwrite the full system configuration, modify platform settings, switch the tracked update branch, and trigger a git pull followed by a dependency reinstall and service restart. Exploiting the write endpoints can lead to immediate configuration corruption or a denial of service for all users on the instance.

Recommendations Update taOS to version 1.0.0-beta.25.