CVE-2026-67529 Details
Description
OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time_entries and GET /api/v3/cost_entries rendered _links.workPackage.title and _links.workPackage.href through associated_resource in modules/costs/lib/api/v3/time_entries/time_entry_representer.rb and modules/costs/lib/api/v3/cost_entries/cost_entry_representer.rb without checking WorkPackage.visible or view_work_packages, allowing users with view_time_entries or view_cost_entries to read private work package subjects and ids. This issue is fixed in 17.6.0.
A vulnerability in OpenProject prior to version 17.6.0 allows unauthorized access to private work package information through the global Time Entries and Cost Entries APIs. The issue arises because these APIs render linked work package titles and IDs without proper visibility checks, enabling users to access subjects and identifiers of work packages they cannot directly view. This vulnerability affects users with specific project permissions, allowing them to read sensitive work package information that should be restricted.
Users can update to OpenProject version 17.6.0, where this vulnerability has been fixed. Instructions for updating can be found in the OpenProject release notes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 30, 2026CISA-ADP
Assessed Jul 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/opf/openproject/commit/9e9e562e516a647f35267df715d875f58b267c18 | [email protected] | Source CodeVendor |
| https://github.com/opf/openproject/commit/c31c2f958c8e72a0d0d748d728221d57f3ef9001 | [email protected] | Source CodeVendor |
| https://github.com/opf/openproject/pull/23888 | [email protected] | Issue TrackingVendor |
| https://github.com/opf/openproject/pull/23936 | [email protected] | Issue TrackingVendor |
| https://github.com/opf/openproject/releases/tag/v17.6.0 | [email protected] | Release NotesVendor |
| https://github.com/opf/openproject/security/advisories/GHSA-v3j7-vqwv-5w5q | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenProject | <= 17.5.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 31, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2026 | New CVE Received | [email protected] |