Executive brief
OpenProject, a web-based project management tool, contains a security flaw that allows project members to view information they are not authorized to see. An authenticated user can access the titles and sharing details of all work packages within a project, even those marked as confidential or private. This could lead to the exposure of sensitive project data, including confidential task names and the identities of users with special access roles.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in OpenProject's Shares API. The 'GET /api/v3/shares' endpoint fails to perform granular visibility checks on individual work packages, instead relying solely on project-level permissions. Specifically, the 'visible_for_non_admins' scope in 'app/models/members/scopes/visible.rb' does not filter results by 'WorkPackage.visible(user)'. An authenticated attacker with 'view_shared_work_packages' permissions can enumerate all work package shares in a project, leaking confidential titles, IDs, and user role assignments. The issue is resolved in versions 17.3.2 and 17.4.0 by adding proper entity-level visibility filtering to the database query.
Affected products
- opf OpenProject < 17.3.2, < 17.4.0
Timeline
- 2026-05-13: advisory: Vendor advisory published on GitHub
- 2026-06-26: disclosed: CVE published to NVD
- patched: Fixed in versions 17.3.2 and 17.4.0