CVE-2026-44736

OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retrieve relations — and the subject (title) of work packages they have no permission to view — by supplying an arbitrary work package ID in the involved, fromId, or toId filter. This bypasses the Relation.visible scope due to a flawed performance optimization in RelationQuery. This vulnerability is fixed in 17.4.0.

Score
CVSS 3.1 6.5 Medium
Status
Deferred - security-advisories@github.com
Published
2026-06-26
Last modified
2026-10-25
Weaknesses
CWE-200, CWE-639, CWE-836

Affected products

References

 
 
© AVABIS GmbH privacypolicy about