CVE-2026-44735: OpenProject: Shares API Information Disclosure
OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the GET /api/v3/shares endpoint returns share details for ALL work packages in a project to any user with the viewsharedworkpackages permission. The authorization check operates at the project level only — it does not verify the requesting user can actually view each individual shared work package. This allows a regular project member to discover work package IDs and subjects (including confidential titles), which users have been granted shared access, what role level was assigned (Editor, Commenter, Viewer). This vulnerability is fixed in 17.3.2 and 17.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenProjectto a version that resolves this vulnerability.Fixed in 17.3.2 - Upgrade
Upgrade
OpenProjectto a version that resolves this vulnerability.Fixed in 17.4.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44735?
CVE-2026-44735 has a medium severity score of 6.5.
What type of vulnerability is CVE-2026-44735?
CVE-2026-44735 is categorized as an information disclosure vulnerability.
How do I fix CVE-2026-44735?
To mitigate CVE-2026-44735, update OpenProject to version 17.3.2 or later.
What impact does CVE-2026-44735 have on user data?
CVE-2026-44735 can expose share details of all work packages in a project to unauthorized users.
Which endpoint is affected by CVE-2026-44735?
The vulnerability affects the GET /api/v3/shares endpoint in OpenProject.