CVE-2026-67529: OpenProject: Private work package subject/identity disclosure through the global Time Entries and Cost Entries APIs (linked work package rendered without visibility check)
OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/timeentries and GET /api/v3/costentries rendered links.workPackage.title and links.workPackage.href through associatedresource in modules/costs/lib/api/v3/timeentries/timeentryrepresenter.rb and modules/costs/lib/api/v3/costentries/costentryrepresenter.rb without checking WorkPackage.visible or viewworkpackages, allowing users with viewtimeentries or viewcostentries to read private work package subjects and ids. This issue is fixed in 17.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenProjectto a version that resolves this vulnerability.Fixed in 17.6.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67529?
The severity of CVE-2026-67529 is rated as medium with a score of 4.3.
How do I fix CVE-2026-67529?
To fix CVE-2026-67529, upgrade OpenProject to version 17.6.0 or later.
What is the impact of CVE-2026-67529?
CVE-2026-67529 allows for the disclosure of private work package subject and identity through global API endpoints without proper visibility checks.
Which software is affected by CVE-2026-67529?
CVE-2026-67529 affects OpenProject software versions prior to 17.6.0.
What type of vulnerability is CVE-2026-67529 classified as?
CVE-2026-67529 is classified as an info leak vulnerability.