CVE-2026-67529: OpenProject Information Disclosure in Time and Cost Entry APIs

CVE-2026-67529 · Severity: medium · CVSS 4.3 · Published 2026-07-30

OpenProject is an open-source project management platform used by teams to track tasks, costs, and time entries. A security flaw was identified where users with basic permissions could view the titles and IDs of private 'work packages' (tasks) they were not authorized to see. This could lead to the exposure of sensitive project names or internal task descriptions to unauthorized staff members.

Technologies: OpenProject GmbH OpenProject. Vendors: OpenProject GmbH.

Quick answers

Is CVE-2026-67529 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-67529 being exploited in the wild.
How severe is CVE-2026-67529?
Medium severity, with a CVSS score of 4.3, published 30 July 2026.
Which products and versions are affected?
OpenProject GmbH OpenProject < 17.6.0.
Is there a fix for CVE-2026-67529?
A patch was published on 2026-06-24: Fix merged for time entries contract Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67529 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-67529?
Check whether you run OpenProject GmbH OpenProject at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization check (CWE-862) exists in the OpenProject API endpoints 'GET /api/v3/time_entries' and 'GET /api/v3/cost_entries'. The application rendered '_links.workPackage.title' and '_links.workPackage.href' via the 'associated_resource' method in the time and cost entry representers without verifying 'WorkPackage.visible' or 'view_work_packages' permissions. An authenticated attacker with 'view_time_entries' or 'view_cost_entries' permissions can exploit this to disclose the subjects (titles) and IDs of private work packages. This issue is resolved in version 17.6.0 by implementing proper visibility checks in the representer layer.

Affected products

  • opf OpenProject < 17.6.0

Timeline

  • 2026-06-24: patched: Fix merged for time entries contract
  • 2026-06-25: patched: Fix merged for cost entries contract
  • 2026-07-08: advisory: Release 17.6.0 published
  • 2026-07-30: disclosed: CVE-2026-67529 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.