CVE-2026-67528 Details
Description
OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/custom_options/:id resolved CustomOption records by global numeric id and allowed UserCustomField and GroupCustomField options without checking visible(current_user), so authenticated non-admin users could enumerate sequential custom option ids and read labels belonging to admin_only user or group custom fields. This issue is fixed in 17.6.0.
A vulnerability in OpenProject prior to version 17.6.0 allows authenticated non-admin users to access sensitive data through the custom options API. The issue arises because the API endpoint '/api/v3/custom_options/:id' does not properly validate the visibility of custom fields marked as 'admin_only' before allowing access. This oversight enables users to enumerate custom option IDs and retrieve labels from hidden user or group custom fields, potentially exposing internal classifications that administrators intended to keep confidential.
Users are advised to update OpenProject to version 17.6.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 30, 2026CISA-ADP
Assessed Jul 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/opf/openproject/commit/a13fa079bc8040449570384c19f2d98f637179f1 | [email protected] | Source CodeVendor |
| https://github.com/opf/openproject/releases/tag/v17.6.0 | [email protected] | Release NotesVendor |
| https://github.com/opf/openproject/security/advisories/GHSA-wr3w-qchj-p4cm | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenProject | < 17.6.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 31, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2026 | New CVE Received | [email protected] |