OpenProject EUVD-2026-39880

The attacker must be an authenticated OpenProject project member holding the view_shared_work_packages permission within the targeted project; unauthenticated users cannot exploit this endpoint. The targeted project must have work package sharing enabled and at least some work packages shared with other users to produce meaningful disclosure. The key limiting factor is the required project membership and named permission - users outside the project, or project members whose role does not include view_shared_work_packages, are not affected. Exploitation is strictly limited to read-only disclosure of share metadata (work package IDs, titles, recipient identities, role levels); no write access, privilege escalation, or availability impact is possible through this vector.

The CVSS 6.5 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately characterizes this as a network-accessible, low-complexity information disclosure requiring only a low-privileged account - specifically, an authenticated project membership with a named permission. The high confidentiality impact is justified by exposure of confidential work package subjects and access-control metadata. No EPSS score was provided in the input, no CISA KEV listing exists, and no public exploit code has been identified at time of analysis; opportunistic mass exploitation is therefore unlikely. The realistic threat is insider or semi-trusted actor scenarios: a project member using this endpoint to map confidential work package titles, enumerate privileged external share recipients, or learn the role assignment structure of a project to support social engineering or targeted follow-on access requests. Integrity and Availability impacts are both N, confirming pure information disclosure with no write-path or denial-of-service vector.

An authenticated project member with the view_shared_work_packages permission issues a GET /api/v3/shares request against a target project's API. Because the authorization check does not enforce per-work-package visibility, the response includes share records for every work package in the project - the attacker extracts IDs and titles of confidential work packages they were never granted access to, along with the identities of external share recipients and their assigned roles. No public exploit code has been identified at time of analysis, but the attack requires only a standard authenticated API call with no special tooling.