Quick answers
- Is CVE-2026-44736 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-44736 being exploited in the wild.
- How severe is CVE-2026-44736?
- Medium severity, with a CVSS score of 6.5, published 26 June 2026.
- Which products and versions are affected?
- OpenProject GmbH OpenProject < 17.4.0.
- Is there a fix for CVE-2026-44736?
- A patch was published on 2026-06-26: Fix released in version 17.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-44736 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-44736?
- Check whether you run OpenProject GmbH OpenProject at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An authorization bypass exists in the GET /api/v3/relations endpoint due to a flawed performance optimization in RelationQuery. The RelationQuery#results method skips the .visible scope if certain filters (involved, fromId, or toId) are present, assuming these filters handle visibility checks. However, these filters only validate visibility for one side of a relation, allowing an attacker to supply an unauthorized work package ID and retrieve its subject (title) and relation data if the other side of the relation is visible to them. This allows for bulk enumeration of sensitive work package titles across different projects. The issue is fixed in version 17.4.0.
Affected products
- opf OpenProject < 17.4.0
Timeline
- 2026-03-07: other: Vulnerability verified against development branch HEAD
- 2026-05-13: advisory: Vendor advisory published via GitHub
- 2026-06-26: disclosed: CVE published to NVD
- 2026-06-26: patched: Fix released in version 17.4.0