What is the CVSS score of CVE-2026-49355?

CVE-2026-49355 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-49355?

Yes, a patch is available for CVE-2026-49355. Update the affected software to the latest version immediately.

OpenProject CVE-2026-49355

EUVD-2026-39877 MEDIUM

Information Exposure (CWE-200)

2026-06-26 GitHub_M

Information Disclosure Openproject

4.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable API requiring authenticated session (PR:L); impact limited to partial confidentiality of linked work package data with no integrity or availability effects.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 26, 2026 - 21:02 EUVD

Analysis Generated

Jun 26, 2026 - 20:31 vuln.today

DescriptionCVE.org

OpenProject is open-source, web-based project management software. Prior to 17.4.0, GET /api/v3/meetings/:meeting_id/agenda_items/:agenda_item_id discloses private work package data from a linked work package that belongs to a private/inaccessible project. This vulnerability is fixed in 17.4.0.

AnalysisAI

The meeting agenda items REST API in OpenProject before 17.4.0 leaks private work package data to authenticated users who lack project-level access. When a meeting agenda item is linked to a work package belonging to a private or inaccessible project, the GET /api/v3/meetings/:meeting_id/agenda_items/:agenda_item_id endpoint returns that work package's confidential data in its response, silently bypassing project-level authorization checks. No public exploit is identified at time of analysis and this vulnerability is not listed in CISA KEV; a vendor-released patch is available in version 17.4.0.

Technical ContextAI

OpenProject is a Rails-based, open-source web project management platform offering REST API v3 for programmatic access. The affected endpoint is part of the meetings module, which allows users to create structured meeting agendas and link individual agenda items to work packages across the platform. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) describes the root cause: the API serializer for agenda item responses fails to enforce project-level visibility checks when resolving linked work package references. As a result, the work package data is included in the API response regardless of whether the requesting user holds membership or visibility rights to the work package's parent project. The CPE string cpe:2.3:a:opf:openproject:*:*:*:*:*:*:*:* indicates the wildcard applies across all versions prior to the fix, covering both self-hosted and cloud deployments of the application.

RemediationAI

Vendor-released patch: 17.4.0. Organizations should upgrade to OpenProject 17.4.0 or later, which resolves the authorization bypass in the meeting agenda item serialization layer. Full advisory and upgrade guidance are available at https://github.com/opf/openproject/security/advisories/GHSA-g387-6rm2-xw88. For deployments that cannot immediately upgrade, a practical compensating control is to restrict meeting participant membership exclusively to users who already hold access to all projects from which work packages may be linked in agenda items - this eliminates the cross-project visibility gap but may reduce the collaborative utility of the meetings feature. Administrators should also audit existing meeting agenda items to identify any agenda entries currently linked to work packages in private projects and assess whether unauthorized disclosure has already occurred. Disabling the meetings module entirely, if operationally feasible, eliminates the attack surface at the cost of that feature.