CVE-2026-67528: OpenProject: Improper Access Control through /api/v3/custom_options/:id via Path "id" leads to Sensitive Data Exposure
OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/customoptions/:id resolved CustomOption records by global numeric id and allowed UserCustomField and GroupCustomField options without checking visible(currentuser), so authenticated non-admin users could enumerate sequential custom option ids and read labels belonging to adminonly user or group custom fields. This issue is fixed in 17.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenProjectto a version that resolves this vulnerability.Fixed in 17.6.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67528?
The severity of CVE-2026-67528 is rated as medium with a score of 4.3.
What type of vulnerability is CVE-2026-67528?
CVE-2026-67528 is an improper access control vulnerability that leads to sensitive data exposure.
How do I fix CVE-2026-67528?
To fix CVE-2026-67528, upgrade your OpenProject software to version 17.6.0 or later.
What can be exploited in CVE-2026-67528?
Authenticated non-admin users can exploit CVE-2026-67528 to access sensitive data through the API without proper visibility checks.
What software is affected by CVE-2026-67528?
CVE-2026-67528 affects OpenProject versions prior to 17.6.0.