CVE-2026-47193: OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenProjectto a version that resolves this vulnerability.Fixed in 17.3.3 - Upgrade
Upgrade
OpenProjectto a version that resolves this vulnerability.Fixed in 17.4.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47193?
The severity of CVE-2026-47193 is high with a score of 7.5.
How do I fix CVE-2026-47193?
To fix CVE-2026-47193, upgrade OpenProject to versions 17.3.3 or 17.4.1 or later.
What is the impact of CVE-2026-47193?
CVE-2026-47193 allows the journal diff endpoint to disclose hidden historical field values, leading to potential information leakage.
Which versions of OpenProject are affected by CVE-2026-47193?
OpenProject versions prior to 17.3.3 and 17.4.1 are affected by CVE-2026-47193.
What type of vulnerability is CVE-2026-47193 classified as?
CVE-2026-47193 is classified as an information leak vulnerability.