PT-2026-66574 · Opf · Openproject

CVE-2026-67528 · Publicado 2026-07-30 · Atualizado 2026-07-30

NVD

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/custom options/:id resolved CustomOption records by global numeric id and allowed UserCustomField and GroupCustomField options without checking visible(current user), so authenticated non-admin users could enumerate sequential custom option ids and read labels belonging to admin only user or group custom fields. This issue is fixed in 17.6.0.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-67528

Produtos afetados

Openproject

Referências · 4

• https://github.com/opf/openproject/releases/tag/v17.6.0 · Nota
• https://github.com/opf/openproject/commit/a13fa079bc8040449570384c19f2d98f637179f1 · Nota
• https://github.com/opf/openproject/security/advisories/GHSA-wr3w-qchj-p4cm · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-67528 · Nota de Segurança