OpenProject CVE-2026-49355

Exploitation requires a valid authenticated session with at least low-privilege access (CVSS PR:L). The critical precondition is the existence of a meeting agenda item - visible to the attacker - that has been linked to a work package residing in a project the attacker cannot access. This cross-project linking must have been performed by a higher-privileged user (e.g., a project manager or admin) who has access to both the meeting and the private project. The OpenProject meetings module must be in use on the target instance. Exploitation is limited by: (1) the attacker must be authenticated; (2) valid meeting and agenda item IDs must be known or guessable; (3) at least one cross-project work package link must exist in an accessible meeting. Instances that do not use the meetings feature, or where all work packages linked in meeting agendas belong to projects visible to all meeting participants, are not exploitable.

The CVSS 3.1 score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N accurately captures the risk profile: network-accessible, low-complexity, but requiring an authenticated session (PR:L), with limited confidentiality impact and no integrity or availability consequences. No EPSS data was supplied, and the vulnerability does not appear in CISA KEV, suggesting no confirmed active exploitation at time of analysis. No public POC is identified. Real-world risk is contextual: organizations where the meetings module is actively used to cross-link work packages from projects with mixed visibility levels face meaningful confidentiality exposure, particularly if sensitive roadmap items, security issues, or HR-related work packages reside in restricted projects. For organizations that do not use the meetings module or do not link cross-project work packages, the effective risk is negligible. The flaw is not automatable at scale since exploitation requires knowledge of valid meeting and agenda item identifiers, and the impact per-request is bounded to specific linked work package fields rather than broad data extraction.

An authenticated user with a low-privilege OpenProject account and access to a meeting sends a GET request to /api/v3/meetings/:meeting_id/agenda_items/:agenda_item_id for an agenda item that an administrator has linked to a work package from a private project. The API response includes the private work package's title, description, status, and other metadata that the requester is not authorized to see. By iterating over agenda item identifiers within accessible meetings, the attacker can harvest confidential project data from restricted projects without holding any membership in those projects.