Junglewise Threat Intelligence

CVE-2026-67529: OpenProject Information Disclosure in Time and Cost Entry APIs

CVE-2026-67529 · Severity: medium · CVSS 4.3 · Published 2026-07-30

Executive brief

OpenProject is an open-source project management platform used by teams to track tasks, costs, and time entries. A security flaw was identified where users with basic permissions could view the titles and IDs of private 'work packages' (tasks) they were not authorized to see. This could lead to the exposure of sensitive project names or internal task descriptions to unauthorized staff members.

Technical details

A missing authorization check (CWE-862) exists in the OpenProject API endpoints 'GET /api/v3/time_entries' and 'GET /api/v3/cost_entries'. The application rendered '_links.workPackage.title' and '_links.workPackage.href' via the 'associated_resource' method in the time and cost entry representers without verifying 'WorkPackage.visible' or 'view_work_packages' permissions. An authenticated attacker with 'view_time_entries' or 'view_cost_entries' permissions can exploit this to disclose the subjects (titles) and IDs of private work packages. This issue is resolved in version 17.6.0 by implementing proper visibility checks in the representer layer.

Affected products

  • opf OpenProject < 17.6.0

Timeline

  • 2026-06-24: patched: Fix merged for time entries contract
  • 2026-06-25: patched: Fix merged for cost entries contract
  • 2026-07-08: advisory: Release 17.6.0 published
  • 2026-07-30: disclosed: CVE-2026-67529 published

References

Related threats