What is the CVSS score of CVE-2026-47193?

CVE-2026-47193 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of OpenProject are affected by CVE-2026-47193?

OpenProject installations running versions before 17.3.3 and 17.4.1 expose a data disclosure vulnerability enabling remote access to restricted work-package field history, potentially revealing…. A patch is available.

How to fix or mitigate CVE-2026-47193?

Within 24 hours: Identify all OpenProject instances running vulnerable versions (before 17.3.3 in the 17.3 branch and before 17.4.1 in the 17.4 branch); assess data sensitivity of affected work-package repositories. Within 7 days: Restrict journal diff endpoint access to authenticated privileged users; implement audit logging on endpoint access; establish communication with OpenProject for patch availability timeline. Within 30 days: Deploy patched versions (17.3.3, 17.4.1, or later once released) to all affected instances; verify visibility control enforcement post-deployment.

OpenProject CVE-2026-47193

EUVD-2026-39872 HIGH

Information Exposure (CWE-200)

2026-06-26 GitHub_M

Information Disclosure Openproject Opf

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable history endpoint with low complexity; a journal/diff view normally needs an authenticated session, so PR:L; pure confidentiality disclosure means C:H, I:N, A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 26, 2026 - 21:02 EUVD

Analysis Generated

Jun 26, 2026 - 19:48 vuln.today

DescriptionCVE.org

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1.

AnalysisAI

Information disclosure in OpenProject before 17.3.3 and 17.4.1 lets remote attackers read hidden historical field values through the journal diff endpoint, which fails to enforce object- and field-level visibility checks. The flaw (CWE-200) carries a CVSS 7.5 driven entirely by high confidentiality impact, exposing prior values of work-package fields that should be restricted. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

OpenProject (CPE cpe:2.3:a:opf:openproject) is a Ruby on Rails web-based project and work-package management platform that records every change to a work package as a 'journal' entry, enabling an audit/history diff view. The journal diff endpoint computes and returns the before/after values of changed fields. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the diff rendering path does not re-apply the same object visibility and per-field permission filters that the normal work-package views enforce, so historical values of restricted objects or fields are serialized into the diff response regardless of the requester's authorization.

RemediationAI

Vendor-released patch: upgrade to OpenProject 17.3.3 (for 17.3.x deployments) or 17.4.1 (for 17.4.x deployments) per advisory GHSA-f2rx-x2qj-2hgj (https://github.com/opf/openproject/security/advisories/GHSA-f2rx-x2qj-2hgj). If immediate upgrade is not possible, restrict network reachability of the OpenProject instance - place it behind a VPN or IP allowlist and ensure it is not exposed to untrusted users - and tighten project/work-package membership so fewer accounts have access to sensitive work packages, accepting that this only narrows the audience rather than closing the disclosure. As a stopgap you can also block or proxy-filter requests to the journal diff/history endpoint at a reverse proxy, with the side effect of breaking legitimate change-history views for all users; this is a usability trade-off and not a substitute for the patch.