CVE-2026-44735: OpenProject incorrect authorization in Shares API

CVE-2026-44735 · Severity: medium · CVSS 6.5 · Published 2026-06-26

OpenProject, a web-based project management tool, contains a security flaw that allows project members to view information they are not authorized to see. An authenticated user can access the titles and sharing details of all work packages within a project, even those marked as confidential or private. This could lead to the exposure of sensitive project data, including confidential task names and the identities of users with special access roles.

Quick answers

Is CVE-2026-44735 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44735 being exploited in the wild.
How severe is CVE-2026-44735?
Medium severity, with a CVSS score of 6.5, published 26 June 2026.
Which products and versions are affected?
opf OpenProject < 17.3.2, < 17.4.0.
Is there a fix for CVE-2026-44735?
A patch was published: Fixed in versions 17.3.2 and 17.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44735 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-44735?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incorrect authorization vulnerability (CWE-863) exists in OpenProject's Shares API. The 'GET /api/v3/shares' endpoint fails to perform granular visibility checks on individual work packages, instead relying solely on project-level permissions. Specifically, the 'visible_for_non_admins' scope in 'app/models/members/scopes/visible.rb' does not filter results by 'WorkPackage.visible(user)'. An authenticated attacker with 'view_shared_work_packages' permissions can enumerate all work package shares in a project, leaking confidential titles, IDs, and user role assignments. The issue is resolved in versions 17.3.2 and 17.4.0 by adding proper entity-level visibility filtering to the database query.

Affected products

  • opf OpenProject < 17.3.2, < 17.4.0

Timeline

  • 2026-05-13: advisory: Vendor advisory published on GitHub
  • 2026-06-26: disclosed: CVE published to NVD
  • patched: Fixed in versions 17.3.2 and 17.4.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.