CVE-2026-44736 Details
Description
OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retrieve relations — and the subject (title) of work packages they have no permission to view — by supplying an arbitrary work package ID in the involved, fromId, or toId filter. This bypasses the Relation.visible scope due to a flawed performance optimization in RelationQuery. This vulnerability is fixed in 17.4.0.
A vulnerability exists in OpenProject versions prior to 17.4.0, where the GET /api/v3/relations endpoint allows authenticated users to access subjects of work packages they are not authorized to view. This is achieved by manipulating work package IDs in certain filters, which bypasses the intended visibility checks. The issue stems from a performance optimization that incorrectly assumes all relation sides are validated, leading to unauthorized information disclosure.
Users can update to OpenProject version 17.4.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 26, 2026CISA-ADP
Assessed Jun 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/opf/openproject/security/advisories/GHSA-p9gq-hrgh-2645 | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/opf/openproject/security/advisories/GHSA-p9gq-hrgh-2645 | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
| CWE-836 | Use of Password Hash Instead of Password for Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenProject | <= 17.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 27, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | New CVE Received | [email protected] |