PT-2026-52908 · Unknown · Openproject
CVE-2026-49355
·
Published
2026-06-26
·
Updated
2026-06-29
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
OpenProject versions prior to 17.4.0
Description
An issue exists where the endpoint
GET /api/v3/meetings/:meeting id/agenda items/:agenda item id discloses private work package data. This occurs when a linked work package belongs to a project that is private or otherwise inaccessible to the user.Recommendations
Update to version 17.4.0.
Exploit
Fix
IDOR
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Openproject