CVE-2026-119665

MediumCVSS 6.3

Published: 30/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

34th percentile - higher than 34% of all known CVEs

Summary

WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet that allows authenticated users to access other projects' tasks. Attackers can set project_pk to another project's sequential ID to modify, delete, or trigger scheduled tasks via run-now and read execution logs.

Risk Assessment

An authenticated user can modify, delete, or trigger other projects' tasks and read their logs, breaking project isolation and compromising data integrity.

Recommendation

Upgrade WHartTest beyond 2.8.1 if a fixed version is available, or enforce project-level authorization in ScheduledTaskViewSet and TaskExecutionViewSet. Monitor for unusual requests using other projects' project_pk identifiers.

Other vulnerabilities in WHartTest

CVE-2026-111617Medium
WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id to intercept other users' test-case payloads, receive broadcast step results, and spoof results and screen frames into victim sessions.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS