PT-2026-52907 · Unknown · Openproject

CVE-2026-47193

Published

2026-06-26

Updated

2026-06-26

CVSS v3.1

7.5

High

Vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.3.3 OpenProject versions prior to 17.4.1

Description The journal diff endpoint discloses hidden historical field values because it fails to enforce object and field visibility.

Recommendations Update to version 17.3.3. Update to version 17.4.1.

Exploit

Fix

Information Disclosure

Missing Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾

CVE-2026-47193

GHSA-F2RX-X2QJ-2HGJ

Openproject