CVE-2026-47193

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/opf/openproject/security/advisories/GHSA-f2rx-x2qj-2hgj
https://github.com/opf/openproject/security/advisories/GHSA-f2rx-x2qj-2hgj

Configurations

No configuration.

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) OpenProject es un software de gestión de proyectos de código abierto y basado en la web. Antes de las versiones 17.3.3 y 17.4.1, el endpoint journal diff divulgaba valores de campos históricos ocultos sin aplicar la visibilidad de objetos y campos. Esta vulnerabilidad se corrigió en las versiones 17.3.3 y 17.4.1.

Information

Published : 2026-06-26 20:17

Updated : 2026-10-25 17:10

NVD link : CVE-2026-47193

Mitre link : CVE-2026-47193

CVE.ORG link : CVE-2026-47193

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-862

Missing Authorization

{"id": "CVE-2026-47193", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47193", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T19:42:16.926258Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "opf", "product": "openproject", "versions": [{"status": "affected", "version": "< 17.3.3"}, {"status": "affected", "version": ">= 17.4.0, < 17.4.1"}]}]}], "published": "2026-06-26T20:17:13.527", "references": [{"url": "https://github.com/opf/openproject/security/advisories/GHSA-f2rx-x2qj-2hgj", "source": "security-advisories@github.com"}, {"url": "https://github.com/opf/openproject/security/advisories/GHSA-f2rx-x2qj-2hgj", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1."}, {"lang": "es", "value": "OpenProject es un software de gesti\u00f3n de proyectos de c\u00f3digo abierto y basado en la web. Antes de las versiones 17.3.3 y 17.4.1, el endpoint journal diff divulgaba valores de campos hist\u00f3ricos ocultos sin aplicar la visibilidad de objetos y campos. Esta vulnerabilidad se corrigi\u00f3 en las versiones 17.3.3 y 17.4.1."}], "lastModified": "2026-10-25T17:10:00.197", "sourceIdentifier": "security-advisories@github.com"}