Executive brief
OpenProject is an open-source project management platform used by teams to track tasks and collaborate. A security flaw allows any logged-in user to view the titles of private tasks (work packages) they are not authorized to see by querying the relations API. This could lead to the exposure of sensitive business information, such as project names, client details, or strategic plans, which are often contained in task titles.
Technical details
An authorization bypass exists in the GET /api/v3/relations endpoint due to a flawed performance optimization in RelationQuery. The RelationQuery#results method skips the .visible scope if certain filters (involved, fromId, or toId) are present, assuming these filters handle visibility checks. However, these filters only validate visibility for one side of a relation, allowing an attacker to supply an unauthorized work package ID and retrieve its subject (title) and relation data if the other side of the relation is visible to them. This allows for bulk enumeration of sensitive work package titles across different projects. The issue is fixed in version 17.4.0.
Affected products
- opf OpenProject < 17.4.0
Timeline
- 2026-03-07: other: Vulnerability verified against development branch HEAD
- 2026-05-13: advisory: Vendor advisory published via GitHub
- 2026-06-26: disclosed: CVE published to NVD
- 2026-06-26: patched: Fix released in version 17.4.0