CVE-2026-55095

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.6.0

Description An authenticated non-admin project member can request the inplace-edit dialog for a raw custom field project attribute. The dialog path resolves the project custom field by its raw identifier without enforcing the admin only visibility scope, which renders the stored custom-field comment in read-only mode. This results in the disclosure of hidden comment text, although it does not disclose the custom-field value or allow for writes or mutation.

Recommendations Update to version 17.6.0.