CVE-2026-69119

Name of the Vulnerable Software and Affected Versions Taubyte Tau version 1.1.10

Description An authorization flaw exists in the services/auth HTTP service. The GitHubTokenHTTPAuth middleware validates the presence of a valid GitHub OAuth token but fails to verify if the user has ownership or access rights to the requested project. This allows an authenticated user to perform cross-tenant project takeover by supplying an arbitrary project ID to the 'GET /projects/{id}' and 'DELETE /projects/{id}' endpoints. This enables unauthorized execution of KV-store operations, specifically the projects.Fetch and project.Delete functions, to read or permanently delete projects belonging to other tenants.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.