What is the CVSS score of CVE-2026-44736?

CVE-2026-44736 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-44736?

Yes, a patch is available for CVE-2026-44736. Update the affected software to the latest version immediately.

OpenProject CVE-2026-44736

EUVD-2026-39876 MEDIUM

Information Exposure (CWE-200)

2026-06-26 GitHub_M

Information Disclosure Openproject

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible API requires only an authenticated session (PR:L); confidentiality is High as restricted work package titles are exposed; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 26, 2026 - 21:02 EUVD

Analysis Generated

Jun 26, 2026 - 20:31 vuln.today

DescriptionCVE.org

OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retrieve relations - and the subject (title) of work packages they have no permission to view - by supplying an arbitrary work package ID in the involved, fromId, or toId filter. This bypasses the Relation.visible scope due to a flawed performance optimization in RelationQuery. This vulnerability is fixed in 17.4.0.

AnalysisAI

Unauthorized information disclosure in OpenProject before 17.4.0 allows any authenticated user to retrieve the subjects (titles) of work packages they have been explicitly denied access to, bypassing project-level visibility controls. The flaw exists in the GET /api/v3/relations REST API endpoint, where supplying arbitrary work package IDs to the involved, fromId, or toId filter parameters circumvents the Relation.visible scope due to a defective performance optimization in RelationQuery. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate to OpenProject with any valid account

Delivery

Enumerate or guess work package IDs via sequential integers

Exploit

Query GET /api/v3/relations with target IDs in fromId or toId filter

Execution

Bypass Relation.visible scope due to flawed performance optimization

Impact

Extract restricted work package titles from API JSON response

Access

Authenticate to OpenProject with any valid account

Delivery

Enumerate or guess work package IDs via sequential integers

Exploit

Query GET /api/v3/relations with target IDs in fromId or toId filter

Execution

Bypass Relation.visible scope due to flawed performance optimization

Impact

Extract restricted work package titles from API JSON response

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid authenticated user session in OpenProject - any role that can log in and access the API suffices (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N is well-calibrated for this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated OpenProject user with a standard non-privileged account iterates over work package IDs by issuing GET /api/v3/relations?filters=[{"fromId":{"operator":"=","values":["<target_id>"]}}] requests, substituting arbitrary work package IDs they have enumerated or guessed. The API returns relation entries that include the subject field of the target work package despite the user having no view permission on that work package or its parent project. …
Remediation	Upgrade to OpenProject 17.4.0 or later, which corrects the flawed Relation.visible scope enforcement in RelationQuery - this is the only confirmed fix per the vendor advisory at https://github.com/opf/openproject/security/advisories/GHSA-p9gq-hrgh-2645. … Detailed patch versions, workarounds, and compensating controls in full report.