# CVE-2026-67528: OpenProject incorrect authorization in custom options API

Source: https://junglewise.ai/threats/cve-2026-67528-openproject-incorrect-authorization-in-custom-options-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-67528 · Severity: medium · CVSS 4.3 · Published 2026-07-30

OpenProject is an open-source project management platform used by teams to track tasks, users, and groups. A security flaw allowed regular users to view sensitive labels and classification data that were intended to be restricted to administrators only. By guessing numeric IDs in the system's web interface, an authenticated user could uncover internal organizational taxonomies or group names they should not have access to.

Technologies: [OpenProject GmbH OpenProject](https://junglewise.ai/threats/technologies/openproject). Vendors: [OpenProject GmbH](https://junglewise.ai/threats/vendors/openproject-gmbh).

## Quick answers

**Is CVE-2026-67528 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67528 being exploited in the wild.

**How severe is CVE-2026-67528?** Medium severity, with a CVSS score of 4.3, published 30 July 2026.

**Which products and versions are affected?** OpenProject GmbH OpenProject < 17.6.0.

**Is there a fix for CVE-2026-67528?** A patch was published on 2026-07-08: Fixed in version 17.6.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67528 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-67528?** Check whether you run OpenProject GmbH OpenProject at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An incorrect authorization vulnerability (CWE-863) exists in the OpenProject API endpoint `GET /api/v3/custom_options/:id`. The application resolved `CustomOption` records by global numeric IDs without verifying if the associated `UserCustomField` or `GroupCustomField` was visible to the requesting user. Because these IDs are sequential, an authenticated attacker could perform an IDOR (Insecure Direct Object Reference) attack to enumerate IDs and disclose labels belonging to `admin_only` fields. This effectively bypasses visibility restrictions intended to hide internal taxonomies from non-administrative users. The issue is fixed in version 17.6.0.

## Affected products

- OpenProject OpenProject < 17.6.0

## Timeline

- 2026-07-08: patched: Fixed in version 17.6.0
- 2026-07-30: disclosed: Public advisory published

## References

- [https://github.com/opf/openproject/commit/a13fa079bc8040449570384c19f2d98f637179f1](https://github.com/opf/openproject/commit/a13fa079bc8040449570384c19f2d98f637179f1)
- [https://github.com/opf/openproject/releases/tag/v17.6.0](https://github.com/opf/openproject/releases/tag/v17.6.0)
- [https://github.com/opf/openproject/security/advisories/GHSA-wr3w-qchj-p4cm](https://github.com/opf/openproject/security/advisories/GHSA-wr3w-qchj-p4cm)

## Related threats

- [OpenProject Information Disclosure in Time and Cost Entry APIs](https://junglewise.ai/threats/cve-2026-67529-openproject-information-disclosure-in-time-and-cost-entry-apis)
- [OpenProject missing authorization in work packages API file links](https://junglewise.ai/threats/cve-2026-67527-openproject-missing-authorization-in-work-packages-api-file-links)
- [OpenProject information disclosure in meeting agenda API](https://junglewise.ai/threats/cve-2026-49355-openproject-information-disclosure-in-meeting-agenda-api)
- [OpenProject Information Disclosure in Relations API Filter](https://junglewise.ai/threats/cve-2026-44736-openproject-information-disclosure-in-relations-api-filter)
- [OpenProject missing authorization in CostReportsController](https://junglewise.ai/threats/cve-2026-44734-openproject-missing-authorization-in-costreportscontroller)