# CVE-2026-55095: OpenProject information disclosure in inplace-edit dialog

Source: https://junglewise.ai/threats/cve-2026-55095-openproject-information-disclosure-in-inplace-edit-dialog  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-55095 · Severity: info · Published 2026-08-20

OpenProject is an open-source web-based project management platform used for planning and collaborating on work across teams. A flaw in versions 17.5.1 and earlier allows authenticated project members to view hidden comments associated with admin-only custom fields by directly accessing the inplace-edit dialog, exposing sensitive information that should remain restricted to administrators.

## Quick answers

**Is CVE-2026-55095 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55095 being exploited in the wild.

**How severe is CVE-2026-55095?** Informational severity, published 20 August 2026.

**Which products and versions are affected?** OpenProject Foundation OpenProject 17.5.1 and earlier.

**Is there a fix for CVE-2026-55095?** A patch was published on 2026-07-08: Fixed in versions 17.5.2 and 17.6.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55095 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55095?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authorization check (CWE-862) in the inplace-edit dialog handler. When a non-admin authenticated user requests the edit dialog for a custom field using its raw identifier, the endpoint bypasses the normal admin_only visibility scope validation and renders stored field comments in read-only mode. The attack requires authentication and project membership but no special privileges. An attacker can disclose custom-field comment text only; the vulnerability does not permit disclosure of field values or mutation of data. The issue is patched in versions 17.5.2 and 17.6.0.

## Affected products

- OpenProject Foundation OpenProject 17.5.1 and earlier

## Timeline

- 2026-07-08: disclosed
- 2026-07-08: patched: Fixed in versions 17.5.2 and 17.6.0
- 2026-08-20: advisory

## References

- [https://github.com/opf/openproject/releases/tag/v17.6.0](https://github.com/opf/openproject/releases/tag/v17.6.0)
- [https://github.com/opf/openproject/security/advisories/GHSA-63fg-pgqj-3qf8](https://github.com/opf/openproject/security/advisories/GHSA-63fg-pgqj-3qf8)