CVE-2026-44735

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the GET /api/v3/shares endpoint returns share details for ALL work packages in a project to any user with the view_shared_work_packages permission. The authorization check operates at the project level only — it does not verify the requesting user can actually view each individual shared work package. This allows a regular project member to discover work package IDs and subjects (including confidential titles), which users have been granted shared access, what role level was assigned (Editor, Commenter, Viewer). This vulnerability is fixed in 17.3.2 and 17.4.0.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/opf/openproject/security/advisories/GHSA-cfg3-f34w-9xx5

Configurations

No configuration.

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) OpenProject es un software de gestión de proyectos de código abierto y basado en la web. Antes de las versiones 17.3.2 y 17.4.0, el endpoint GET /api/v3/shares devuelve detalles de compartición para TODOS los paquetes de trabajo en un proyecto a cualquier usuario con el permiso view_shared_work_packages. La comprobación de autorización opera solo a nivel de proyecto - no verifica que el usuario solicitante pueda realmente ver cada paquete de trabajo compartido individual. Esto permite a un miembro regular del proyecto descubrir IDs y asuntos de paquetes de trabajo (incluyendo títulos confidenciales), a qué usuarios se les ha concedido acceso compartido, qué nivel de rol se asignó (Editor, Comentarista, Visor). Esta vulnerabilidad está corregida en las versiones 17.3.2 y 17.4.0.

Information

Published : 2026-06-26 20:17

Updated : 2026-10-25 17:10

NVD link : CVE-2026-44735

Mitre link : CVE-2026-44735

CVE.ORG link : CVE-2026-44735

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-44735", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44735", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-29T15:00:12.504884Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "opf", "product": "openproject", "versions": [{"status": "affected", "version": "< 17.3.2"}]}]}], "published": "2026-06-26T20:17:03.520", "references": [{"url": "https://github.com/opf/openproject/security/advisories/GHSA-cfg3-f34w-9xx5", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the GET /api/v3/shares endpoint returns share details for ALL work packages in a project to any user with the view_shared_work_packages permission. The authorization check operates at the project level only \u2014 it does not verify the requesting user can actually view each individual shared work package. This allows a regular project member to discover work package IDs and subjects (including confidential titles), which users have been granted shared access, what role level was assigned (Editor, Commenter, Viewer). This vulnerability is fixed in 17.3.2 and 17.4.0."}, {"lang": "es", "value": "OpenProject es un software de gesti\u00f3n de proyectos de c\u00f3digo abierto y basado en la web. Antes de las versiones 17.3.2 y 17.4.0, el endpoint GET /api/v3/shares devuelve detalles de compartici\u00f3n para TODOS los paquetes de trabajo en un proyecto a cualquier usuario con el permiso view_shared_work_packages. La comprobaci\u00f3n de autorizaci\u00f3n opera solo a nivel de proyecto - no verifica que el usuario solicitante pueda realmente ver cada paquete de trabajo compartido individual. Esto permite a un miembro regular del proyecto descubrir IDs y asuntos de paquetes de trabajo (incluyendo t\u00edtulos confidenciales), a qu\u00e9 usuarios se les ha concedido acceso compartido, qu\u00e9 nivel de rol se asign\u00f3 (Editor, Comentarista, Visor). Esta vulnerabilidad est\u00e1 corregida en las versiones 17.3.2 y 17.4.0."}], "lastModified": "2026-10-25T17:10:00.197", "sourceIdentifier": "security-advisories@github.com"}