Threat Intelligence Database

CVE-2026-55095 is a medium severity vulnerability in OpenProject, an open-source project management software. In versions 17.5.1 and earlier, authenticated non-admin project members can access a read-only dialog that reveals hidden comment text of a raw custom project field. This disclosure does not include the custom field's value nor does it allow modification. The issue is fixed in version 17.6.0.

OpenProject versions prior to 17.6.0 have a vulnerability where certain API endpoints expose private work package titles and IDs to users who have permission to view time or cost entries but not the work packages themselves. This occurs because the API renders work package links without verifying if the user has visibility permissions. The issue is fixed in version 17.6.0.

OpenProject versions prior to 17.6.0 contain an authorization flaw where authenticated non-admin users can enumerate sequential custom option IDs and access labels of admin-only user or group custom fields. This issue is resolved in version 17.6.0.

OpenProject versions prior to 17.6.0 contain a missing authorization vulnerability in the PATCH /api/v3/work_packages/{id} endpoint. Authenticated users with edit_work_packages permission but without manage_file_links permission could manipulate file link records by raw ID, including detaching, hard-deleting, or re-parenting FileLinks to attacker-controlled work packages. This exposed metadata such as origin filename, origin ID, and MIME type. The issue is fixed in version 17.6.0.

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass password requirements. A password validation flaw in the change password behavior allows attackers to change a user's password only with an active session takeover. This vulnerability is fixed in 17.3.2 and 17.4.0.

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the web application's meetings filter feature leaks whether a given user ID corresponds to a valid account and discloses the user's full name, allowing an attacker to enumerate all existing user accounts by probing user IDs and observing differences in the server response. This vulnerability is fixed in 17.3.2 and 17.4.0.

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, OpenProject exposes a document update endpoint used to modify existing documents. The target document is loaded with visibility checks and then updated. During update, attacker-controlled attributes are applied to the persisted record before authorization is enforced. As a result, a user without :manage_documents in the source project can move and modify foreign project documents by setting project_id in a single PATCH request. This vulnerability is fixed in 17.3.2 and 17.4.0.

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, a Missing Authorization vulnerability exists in OpenProject's CostReportsController. The rename and update actions allow any authenticated user to modify the name, filters, and grouping of any Public cost report in the system without verifying ownership or permission level. An attacker who discovers or guesses a public report's numeric ID can rename or overwrite its filter configuration without any warning to the report's owner. This vulnerability is fixed in 17.3.2 and 17.4.0.

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the GET /api/v3/shares endpoint returns share details for ALL work packages in a project to any user with the view_shared_work_packages permission. The authorization check operates at the project level only — it does not verify the requesting user can actually view each individual shared work package. This allows a regular project member to discover work package IDs and subjects (including confidential titles), which users have been granted shared access, what role level was assigned (Editor, Commenter, Viewer). This vulnerability is fixed in 17.3.2 and 17.4.0.

OpenProject is open-source, web-based project management software. Prior to 17.4.0, OpenProject's rich text (markdown) rendering pipeline uses Sanitize::Config::RELAXED[:css] for inline style sanitization. This configuration permits essentially all CSS properties in style attributes on permitted HTML elements (figure, img, table, th, tr, td). This allows any authenticated user with write access to formattable text fields (work package descriptions, comments, project descriptions, news) to inject CSS This vulnerability is fixed in 17.4.0.