OpenProject CVE-2026-55095

Exploitation requires an active authenticated session with at least non-admin project member privileges in the target OpenProject instance. The target project must have one or more custom fields configured with the admin_only visibility flag that also contain stored comment text. The attacker must know or enumerate the raw custom_field_ integer identifier for the target field. Exploitation is strictly read-only: it discloses only the comment text associated with the hidden custom field, not the field's value, not other project data, and permits no writes or mutations. Exploitation is additionally constrained to environments where administrators have actually populated the comment field of admin-only custom fields with sensitive content - a non-default usage pattern. The scope of disclosure does not extend to other systems or users beyond what is visible in the inplace-edit dialog response.

The CVSS 4.0 base score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) accurately characterizes the threat surface: network-reachable, low complexity, but requiring an authenticated low-privilege session, with only limited confidentiality impact. No EPSS data was provided in the source intelligence; given the narrow impact (comment text only, no value disclosure, no write access), real-world exploitation incentive is low. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept has been identified. The practical risk is further bounded by the requirement that sensitive content must actually be stored in the comment field of an admin-only custom field - a non-default usage pattern. This is a genuine access control gap but its blast radius is narrow, making it a medium-priority patching item rather than an emergency response trigger. No conflicting signals detected; CVSS vector and description are mutually consistent.

An authenticated non-admin project member, aware of the hidden custom field naming convention, crafts a direct HTTP GET request to the inplace-edit dialog endpoint with a known or sequentially guessed raw custom_field_ identifier. The application resolves the field, skips the admin_only visibility check, and returns the rendered comment text in the response. The attacker reads internal notes, metadata, or configuration commentary stored in those hidden fields by administrators - content that was never intended to be visible to regular project members. No public exploit code has been identified at time of analysis.