# CVE-2026-44736: OpenProject Information Disclosure in Relations API Filter

Source: https://junglewise.ai/threats/cve-2026-44736-openproject-information-disclosure-in-relations-api-filter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-44736 · Severity: medium · CVSS 6.5 · Published 2026-06-26

OpenProject is an open-source project management platform used by teams to track tasks and collaborate. A security flaw allows any logged-in user to view the titles of private tasks (work packages) they are not authorized to see by querying the relations API. This could lead to the exposure of sensitive business information, such as project names, client details, or strategic plans, which are often contained in task titles.

Technologies: [OpenProject GmbH OpenProject](https://junglewise.ai/threats/technologies/openproject). Vendors: [OpenProject GmbH](https://junglewise.ai/threats/vendors/openproject-gmbh).

## Quick answers

**Is CVE-2026-44736 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44736 being exploited in the wild.

**How severe is CVE-2026-44736?** Medium severity, with a CVSS score of 6.5, published 26 June 2026.

**Which products and versions are affected?** OpenProject GmbH OpenProject < 17.4.0.

**Is there a fix for CVE-2026-44736?** A patch was published on 2026-06-26: Fix released in version 17.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44736 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-44736?** Check whether you run OpenProject GmbH OpenProject at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authorization bypass exists in the GET /api/v3/relations endpoint due to a flawed performance optimization in RelationQuery. The RelationQuery#results method skips the .visible scope if certain filters (involved, fromId, or toId) are present, assuming these filters handle visibility checks. However, these filters only validate visibility for one side of a relation, allowing an attacker to supply an unauthorized work package ID and retrieve its subject (title) and relation data if the other side of the relation is visible to them. This allows for bulk enumeration of sensitive work package titles across different projects. The issue is fixed in version 17.4.0.

## Affected products

- opf OpenProject < 17.4.0

## Timeline

- 2026-03-07: other: Vulnerability verified against development branch HEAD
- 2026-05-13: advisory: Vendor advisory published via GitHub
- 2026-06-26: disclosed: CVE published to NVD
- 2026-06-26: patched: Fix released in version 17.4.0

## References

- [https://github.com/opf/openproject/security/advisories/GHSA-p9gq-hrgh-2645](https://github.com/opf/openproject/security/advisories/GHSA-p9gq-hrgh-2645)

## Related threats

- [OpenProject Information Disclosure in Time and Cost Entry APIs](https://junglewise.ai/threats/cve-2026-67529-openproject-information-disclosure-in-time-and-cost-entry-apis)
- [OpenProject incorrect authorization in custom options API](https://junglewise.ai/threats/cve-2026-67528-openproject-incorrect-authorization-in-custom-options-api)
- [OpenProject missing authorization in work packages API file links](https://junglewise.ai/threats/cve-2026-67527-openproject-missing-authorization-in-work-packages-api-file-links)
- [OpenProject information disclosure in meeting agenda API](https://junglewise.ai/threats/cve-2026-49355-openproject-information-disclosure-in-meeting-agenda-api)
- [OpenProject missing authorization in CostReportsController](https://junglewise.ai/threats/cve-2026-44734-openproject-missing-authorization-in-costreportscontroller)