CVE-2026-67529

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.6.0

Description An issue exists where the API endpoints 'GET /api/v3/time entries' and 'GET /api/v3/cost entries' render links.workPackage.title and links.workPackage.href via the associated resource in the files modules/costs/lib/api/v3/time entries/time entry representer.rb and modules/costs/lib/api/v3/cost entries/cost entry representer.rb. The system fails to verify WorkPackage.visible or view work packages, which allows users with view time entries or view cost entries permissions to read private work package subjects and IDs.

Recommendations Update to version 17.6.0.