Getrebuild Rebuild vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Getrebuild Rebuild: 2 record(s), with affected versions and fixes.
CVE-2026-111667
Medium · 4.3
CWE-639 Oct 16, 2026
REBUILD through 4.5.0 Missing Authorization via /project/comments/list Endpoint
REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id of a task in a private project to the /project/comments/list endpoint to retrieve its comment content and attachment references.
CVE-2026-110611
Medium · 5.9
CWE-639 Oct 14, 2026
REBUILD through 4.5.0 Authorization Bypass via aibot2 Chat Endpoints chatid
REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privilege users can supply another user's chatid to chat-init, chat-delete, chat-feedback, or chat-stream-stop to read, delete, exfiltrate, or interrupt AI assistant conversations.