Executive brief
OpenProject is an open-source web-based project management platform used for planning and collaborating on work across teams. A flaw in versions 17.5.1 and earlier allows authenticated project members to view hidden comments associated with admin-only custom fields by directly accessing the inplace-edit dialog, exposing sensitive information that should remain restricted to administrators.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the inplace-edit dialog handler. When a non-admin authenticated user requests the edit dialog for a custom field using its raw identifier, the endpoint bypasses the normal admin_only visibility scope validation and renders stored field comments in read-only mode. The attack requires authentication and project membership but no special privileges. An attacker can disclose custom-field comment text only; the vulnerability does not permit disclosure of field values or mutation of data. The issue is patched in versions 17.5.2 and 17.6.0.
Affected products
- OpenProject Foundation OpenProject 17.5.1 and earlier
Timeline
- 2026-07-08: disclosed
- 2026-07-08: patched: Fixed in versions 17.5.2 and 17.6.0
- 2026-08-20: advisory