PT-2026-66574 · Opf · Openproject

CVE-2026-67528 · Published 2026-07-30 · Updated 2026-07-30

NVD

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/custom options/:id resolved CustomOption records by global numeric id and allowed UserCustomField and GroupCustomField options without checking visible(current user), so authenticated non-admin users could enumerate sequential custom option ids and read labels belonging to admin only user or group custom fields. This issue is fixed in 17.6.0.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-67528

Affected Products

Openproject

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-67528 · Security Note
• https://github.com/opf/openproject/releases/tag/v17.6.0 · Note
• https://github.com/opf/openproject/commit/a13fa079bc8040449570384c19f2d98f637179f1 · Note
• https://github.com/opf/openproject/security/advisories/GHSA-wr3w-qchj-p4cm · Note