CVE-2026-44736
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk20th percentile — higher than 20% of all known CVEs
Summary
A vulnerability in OpenProject before version 17.4.0 allows an authenticated user to retrieve relations and the subject (title) of work packages they have no permission to view via the GET /api/v3/relations endpoint. The issue stems from a flawed performance optimization in RelationQuery that bypasses the Relation.visible scope.
Risk Assessment
The organization is at risk of leaking confidential information, such as work package titles, that should only be accessible to authorized users. This could lead to security policy violations and loss of data control.
Recommendation
Update OpenProject to version 17.4.0 or later immediately, which includes a fix for this vulnerability.
Original NVD description (English source)
OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retrieve relations — and the subject (title) of work packages they have no permission to view — by supplying an arbitrary work package ID in the involved, fromId, or toId filter. This bypasses the Relation.visible scope due to a flawed performance optimization in RelationQuery. This vulnerability is fixed in 17.4.0.