PT-2026-52905 · Unknown · Openproject
CVE-2026-44736
·
Published
2026-06-26
·
Updated
2026-06-27
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
OpenProject versions prior to 17.4.0
Description
An issue in the
RelationQuery performance optimization allows authenticated users to bypass the Relation.visible scope. By providing an arbitrary work package ID through the involved, fromId, or toId filters at the 'GET /api/v3/relations' endpoint, a user can retrieve relations and the titles of work packages for which they lack the necessary viewing permissions.Recommendations
Update to version 17.4.0.
Exploit
Fix
IDOR
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Openproject