What is the CVSS score of CVE-2026-67529?

CVE-2026-67529 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-67529?

Yes, a patch is available for CVE-2026-67529. Update the affected software to the latest version immediately.

OpenProject CVE-2026-67529

EUVD-2026-51292 MEDIUM

Information Exposure (CWE-200)

2026-07-30 GitHub_M

Information Disclosure Openproject Opf

4.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-exploitable API endpoint; PR:L because authenticated low-privilege session required; C:L as only titles and IDs are disclosed, no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 30, 2026 - 21:04 EUVD

Source Code Evidence Fetched

Jul 30, 2026 - 20:50 vuln.today

Analysis Generated

Jul 30, 2026 - 20:50 vuln.today

DescriptionCVE.org

OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time_entries and GET /api/v3/cost_entries rendered _links.workPackage.title and _links.workPackage.href through associated_resource in modules/costs/lib/api/v3/time_entries/time_entry_representer.rb and modules/costs/lib/api/v3/cost_entries/cost_entry_representer.rb without checking WorkPackage.visible or view_work_packages, allowing users with view_time_entries or view_cost_entries to read private work package subjects and ids. This issue is fixed in 17.6.0.

AnalysisAI

Authenticated users with time or cost entry viewing permissions can read private work package subjects and IDs via the OpenProject REST API in versions prior to 17.6.0. The /api/v3/time_entries and /api/v3/cost_entries endpoints expose _links.workPackage.title and _links.workPackage.href through the associated_resource rendering path without enforcing WorkPackage.visible or view_work_packages permission checks. An attacker with only view_time_entries or view_cost_entries can enumerate titles and IDs of work packages they should not have access to, violating project confidentiality controls. No public exploit or CISA KEV listing exists; the fix is available in v17.6.0.

Technical ContextAI

OpenProject is a Ruby on Rails web application using Grape-based API representers (modules/costs/lib/api/v3/time_entries/time_entry_representer.rb and cost_entry_representer.rb). The representers render associated resource links including _links.workPackage.title and .href via an associated_resource helper, but this rendering path did not invoke the WorkPackage.visible scope or check the view_work_packages permission. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) precisely describes the root cause: an authorization bypass where the access control enforcement layer was skipped in the serialization path. CPE cpe:2.3:a:opf:openproject:*:*:*:*:*:*:*:* covers all versions; the fix landed in v17.6.0. The PR diff also reveals the fix broadened entity visibility validation to cover Meeting entities, indicating the underlying contract validation (base_contract.rb) was also incomplete for non-WorkPackage entity types.

RemediationAI

Upgrade to OpenProject v17.6.0 or later, which includes the fix via commits 9e9e562e516a647f35267df715d875f58b267c18 and c31c2f958c8e72a0d0d748d728221d57f3ef9001 as referenced in PRs #23888 and #23936. The release is available at https://github.com/opf/openproject/releases/tag/v17.6.0. If immediate upgrade is not possible, a compensating control is to restrict the view_time_entries and view_cost_entries permissions to only trusted users who already hold view_work_packages on the same projects; this reduces the population of users who could exploit the bypass, though it does not eliminate the underlying flaw. Note that restricting these permissions may impact legitimate time and cost reporting workflows.