CVE-2026-55095: OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields
OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw customfield project attribute. The dialog path resolves the project custom field by its raw identifier without enforcing the normal adminonly visibility scope and renders the stored custom-field comment in read-only mode. This discloses hidden comment text but does not disclose the custom-field value or permit writes or mutation. This issue is reported as fixed in version 17.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenProjectto a version that resolves this vulnerability.Fixed in 17.6.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated non-admin member of an affected project can exploit it. The issue affects access to comments associated with admin-only project custom fields.
What information can be exposed, and can an attacker modify it?
The inplace-edit dialog can disclose the stored comment text for the hidden custom field in read-only mode. It does not disclose the custom-field value and does not permit writes or other mutation.
Which versions are affected and what is the fix?
OpenProject 17.5.1 and earlier are affected. The issue is reported as fixed in version 17.6.0.