CVE-2026-47193

Published: Jun 26, 2026Modified: Jun 26, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1.

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (2)

https://github.com/opf/openproject/security/advisories/GHSA-f2rx-x2qj-2hgj

Source: security-advisories@github.com

https://github.com/opf/openproject/security/advisories/GHSA-f2rx-x2qj-2hgj

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.