CVE-2026-67528

Published: Jul 30, 2026Modified: Jul 31, 2026Deferred

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/custom_options/:id resolved CustomOption records by global numeric id and allowed UserCustomField and GroupCustomField options without checking visible(current_user), so authenticated non-admin users could enumerate sequential custom option ids and read labels belonging to admin_only user or group custom fields. This issue is fixed in 17.6.0.

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (3)

https://github.com/opf/openproject/commit/a13fa079bc8040449570384c19f2d98f637179f1

Source: security-advisories@github.com

https://github.com/opf/openproject/releases/tag/v17.6.0

Source: security-advisories@github.com

https://github.com/opf/openproject/security/advisories/GHSA-wr3w-qchj-p4cm

Source: security-advisories@github.com

Timeline

No history available yet.