OpenProject CVE-2026-47193

Exploitation requires reaching the journal diff (work-package change-history) endpoint and requesting the diff for an object or field the requester is not authorized to view; the bug is that the endpoint does not re-enforce object and field visibility, so restricted historical values are returned. The CVSS vector states PR:N/UI:N (no privileges or user interaction), but a journal/history endpoint is normally accessible only within an authenticated session, so realistically a logged-in account on the instance is the limiting factor - verify auth requirement against the GHSA advisory. Limiting factors: the target must run a version prior to 17.3.3 or 17.4.1, the instance must be network-reachable to the attacker, and impact is confined to confidentiality (no data modification or service disruption). Authentication requirements are not fully confirmed from the available data because the CVSS PR:N appears inconsistent with the endpoint's nature.

The vendor-provided CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5) models a network-reachable, low-complexity, no-interaction, unauthenticated read with high confidentiality and no integrity or availability impact, which is internally consistent for a pure data-disclosure bug. However, PR:N conflicts with the typical reality of a journal/history endpoint, which is usually reachable only by an authenticated session - the disclosure is about bypassing field/object visibility rather than bypassing login - so the practical privilege requirement is likely PR:L; verify with the GHSA advisory. No EPSS score, KEV entry, POC, or SSVC decision data was supplied, so exploitation probability cannot be quantified from the input. Treating it as an authenticated information-disclosure issue, real-world risk is moderate: it leaks data but grants no code execution or modification. Prioritize patching on internet-exposed or multi-tenant instances where confidentiality of work-package history matters.

An attacker with access to an OpenProject instance requests the journal/history diff for a work package whose fields or related objects they are not authorized to see. Because the diff endpoint omits the visibility checks, the response returns the hidden historical values - for example previously redacted custom-field contents or restricted descriptions - disclosing data the attacker could not view through the normal UI. No public POC is currently identified, and exploitation needs only a crafted request, consistent with the low attack complexity.