traQ vulnerabilities

2 known vulnerabilities in traQ from traPtitech. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.3 High severity

  traQ: Incorrect Authorization

  CVE-2026-63198Nov 3, 2026traPtitech

  traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope set even though all sco

• 7.3 High severity

  traQ: Improper Neutralization of Input During Web Page Generation

  CVE-2026-63197Nov 3, 2026traPtitech

  traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An a