PT-2026-66602 · Opf · Openproject

CVE-2026-67529 · Published 2026-07-30 · Updated 2026-07-30

NVD

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time entries and GET /api/v3/cost entries rendered links.workPackage.title and links.workPackage.href through associated resource in modules/costs/lib/api/v3/time entries/time entry representer.rb and modules/costs/lib/api/v3/cost entries/cost entry representer.rb without checking WorkPackage.visible or view work packages, allowing users with view time entries or view cost entries to read private work package subjects and ids. This issue is fixed in 17.6.0.

Fix

Information Disclosure

Missing Authorization

Weakness Enumeration

CWE-200

CWE-862

Related Identifiers

CVE-2026-67529

Affected Products

Openproject

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-67529 · Security Note
• https://github.com/opf/openproject/commit/c31c2f958c8e72a0d0d748d728221d57f3ef9001 · Note
• https://github.com/opf/openproject/pull/23888 · Note
• https://github.com/opf/openproject/security/advisories/GHSA-v3j7-vqwv-5w5q · Note
• https://github.com/opf/openproject/commit/9e9e562e516a647f35267df715d875f58b267c18 · Note
• https://github.com/opf/openproject/pull/23936 · Note
• https://github.com/opf/openproject/releases/tag/v17.6.0 · Note