PT-2026-66602 · Opf · Openproject

CVE-2026-67529 · Publicado 2026-07-30 · Atualizado 2026-07-30

NVD

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time entries and GET /api/v3/cost entries rendered links.workPackage.title and links.workPackage.href through associated resource in modules/costs/lib/api/v3/time entries/time entry representer.rb and modules/costs/lib/api/v3/cost entries/cost entry representer.rb without checking WorkPackage.visible or view work packages, allowing users with view time entries or view cost entries to read private work package subjects and ids. This issue is fixed in 17.6.0.

Correção

Information Disclosure

Missing Authorization

Enumeração de Fraquezas

CWE-200

CWE-862

Identificadores relacionados

CVE-2026-67529

Produtos afetados

Openproject

Referências · 7

• https://github.com/opf/openproject/commit/c31c2f958c8e72a0d0d748d728221d57f3ef9001 · Nota
• https://github.com/opf/openproject/pull/23888 · Nota
• https://github.com/opf/openproject/security/advisories/GHSA-v3j7-vqwv-5w5q · Nota
• https://github.com/opf/openproject/commit/9e9e562e516a647f35267df715d875f58b267c18 · Nota
• https://github.com/opf/openproject/pull/23936 · Nota
• https://github.com/opf/openproject/releases/tag/v17.6.0 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-67529 · Nota de Segurança