CVE-2026-44736

OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retrieve relations — and the subject (title) of work packages they have no permission to view — by supplying an arbitrary work package ID in the involved, fromId, or toId filter. This bypasses the Relation.visible scope due to a flawed performance optimization in RelationQuery. This vulnerability is fixed in 17.4.0.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/opf/openproject/security/advisories/GHSA-p9gq-hrgh-2645
https://github.com/opf/openproject/security/advisories/GHSA-p9gq-hrgh-2645

Configurations

No configuration.

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) OpenProject es un software de gestión de proyectos de código abierto y basado en web. Antes de la 17.4.0, el endpoint GET /api/v3/relations permite a cualquier usuario autenticado recuperar relaciones - y el asunto (título) de paquetes de trabajo que no tienen permiso para ver - al proporcionar un ID de paquete de trabajo arbitrario en el filtro involved, fromId o toId. Esto elude el ámbito Relation.visible debido a una optimización de rendimiento defectuosa en RelationQuery. Esta vulnerabilidad se corrigió en la 17.4.0.

Information

Published : 2026-06-26 20:17

Updated : 2026-10-25 17:10

NVD link : CVE-2026-44736

Mitre link : CVE-2026-44736

CVE.ORG link : CVE-2026-44736

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-639

Authorization Bypass Through User-Controlled Key

CWE-836

Use of Password Hash Instead of Password for Authentication

{"id": "CVE-2026-44736", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44736", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-27T02:59:53.577901Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "opf", "product": "openproject", "versions": [{"status": "affected", "version": "< 17.4.0"}]}]}], "published": "2026-06-26T20:17:03.657", "references": [{"url": "https://github.com/opf/openproject/security/advisories/GHSA-p9gq-hrgh-2645", "source": "security-advisories@github.com"}, {"url": "https://github.com/opf/openproject/security/advisories/GHSA-p9gq-hrgh-2645", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-836"}]}], "descriptions": [{"lang": "en", "value": "OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retrieve relations \u2014 and the subject (title) of work packages they have no permission to view \u2014 by supplying an arbitrary work package ID in the involved, fromId, or toId filter. This bypasses the Relation.visible scope due to a flawed performance optimization in RelationQuery. This vulnerability is fixed in 17.4.0."}, {"lang": "es", "value": "OpenProject es un software de gesti\u00f3n de proyectos de c\u00f3digo abierto y basado en web. Antes de la 17.4.0, el endpoint GET /api/v3/relations permite a cualquier usuario autenticado recuperar relaciones - y el asunto (t\u00edtulo) de paquetes de trabajo que no tienen permiso para ver - al proporcionar un ID de paquete de trabajo arbitrario en el filtro involved, fromId o toId. Esto elude el \u00e1mbito Relation.visible debido a una optimizaci\u00f3n de rendimiento defectuosa en RelationQuery. Esta vulnerabilidad se corrigi\u00f3 en la 17.4.0."}], "lastModified": "2026-10-25T17:10:00.197", "sourceIdentifier": "security-advisories@github.com"}