CVE-2026-44736: OpenProject Information Disclosure via Relations API (CVSS 6.5)

Technical summary

The vulnerability exists in the GET /api/v3/relations endpoint prior to version 17.4.0. The RelationQuery class contains a flawed performance optimization that bypasses the Relation.visible scope, which is responsible for enforcing visibility controls. An authenticated attacker can supply arbitrary work package IDs via the involved, fromId, or toId filter parameters to retrieve relations and associated work package subjects (titles) that the user lacks permission to access. The flaw is a failure to apply the visibility scope consistently during query execution, allowing scope-based access control to be circumvented through direct API manipulation.

Business impact

Organizations using OpenProject may experience unintended information disclosure of project structure and work package details to users with basic system access. This could expose sensitive project names, task descriptions, and organizational workflow information to employees or contractors who should have restricted visibility. In regulated environments or during confidential projects, this could lead to compliance violations or competitive intelligence leakage. The impact is primarily confidential; data integrity and system availability are not affected.

Affected systems

OpenProject versions prior to 17.4.0 are affected. The vulnerability requires authentication to exploit, so only users with valid system credentials can conduct the attack. Self-hosted, on-premises, and cloud-hosted deployments are all vulnerable if not upgraded.

Exploitability

Exploitability is straightforward for any authenticated user with knowledge of the API endpoint and work package ID enumeration. No user interaction is required, and the attack can be automated. The network is the only attack vector; no special privileges or system access are needed beyond a valid user account. The CVSS score of 6.5 (MEDIUM) reflects high confidentiality impact offset by the authentication requirement and lack of integrity or availability consequences.

Remediation

Upgrade OpenProject to version 17.4.0 or later, which includes a fix that properly applies the visibility scope during relation queries. Organizations should verify the vendor's release notes for version 17.4.0 to confirm the security patch and any additional requirements or breaking changes.

Patch guidance

Apply the patch by upgrading to OpenProject 17.4.0 or a later version. Follow the vendor's upgrade documentation for your deployment type (cloud-hosted, on-premises, or containerized). Test in a non-production environment first to validate application functionality and data integrity post-upgrade. No rollback complications are anticipated, but backups should be maintained as a precaution.

Detection guidance

Monitor API access logs for repeated or unusual queries to the /api/v3/relations endpoint, particularly with varied fromId, toId, or involved parameter values. Look for patterns of work package ID enumeration or queries from users who do not typically interact with the relations API. Endpoint access logs should show the source user, IP, query parameters, and response size; large result sets or sequential ID queries warrant investigation. Conduct access reviews of users who accessed the relations endpoint to determine if unauthorized information was retrieved.

Why prioritize this

This vulnerability should be prioritized for patching because it enables authenticated information disclosure in a commonly-shared project management system. While not critical, the ease of exploitation (no special privileges or complexity required) and potential exposure of confidential project information make it a near-term remediation candidate. Organizations managing sensitive or regulated projects should treat this as higher priority; general-purpose project management deployments may sequence it after critical patch obligations.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects a high confidentiality impact (C:H) limited by authentication requirement (PR:L) and absence of integrity or availability risk (I:N/A:N). The vector AV:N/AC:L indicates the attack is network-accessible and low-complexity, making it easily exploitable once a user authenticates. The medium severity appropriately balances the serious information exposure risk against the practical barrier of requiring legitimate system access.

Frequently asked questions