Executive brief
OpenProject is an open-source project management platform used by teams to track tasks, users, and groups. A security flaw allowed regular users to view sensitive labels and classification data that were intended to be restricted to administrators only. By guessing numeric IDs in the system's web interface, an authenticated user could uncover internal organizational taxonomies or group names they should not have access to.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in the OpenProject API endpoint `GET /api/v3/custom_options/:id`. The application resolved `CustomOption` records by global numeric IDs without verifying if the associated `UserCustomField` or `GroupCustomField` was visible to the requesting user. Because these IDs are sequential, an authenticated attacker could perform an IDOR (Insecure Direct Object Reference) attack to enumerate IDs and disclose labels belonging to `admin_only` fields. This effectively bypasses visibility restrictions intended to hide internal taxonomies from non-administrative users. The issue is fixed in version 17.6.0.
Affected products
- OpenProject OpenProject < 17.6.0
Timeline
- 2026-07-08: patched: Fixed in version 17.6.0
- 2026-07-30: disclosed: Public advisory published