CVE-2026-49355: OpenProject Information Disclosure in Meeting Agenda API

Technical summary

The vulnerability exists in the `/api/v3/meetings/:meeting_id/agenda_items/:agenda_item_id` GET endpoint prior to version 17.4.0. When an agenda item references a work package from a private or inaccessible project, the API fails to enforce proper access controls before returning the linked work package's details. An authenticated user can exploit this by crafting requests to meeting agenda items and observing sensitive data about work packages they are not authorized to view. The fix in 17.4.0 implements proper authorization checks to ensure work package data is only returned if the user has access to the parent project.

Business impact

This vulnerability undermines project confidentiality in OpenProject deployments. Teams managing sensitive projects—whether internal initiatives, client work, or competitive efforts—risk exposure of task details, timelines, and resource allocation to users outside the intended audience. If work packages contain budget, technical designs, or strategic information, this could compromise competitive advantage or client trust. The impact is further amplified in multi-tenant or multi-department environments where access controls are relied upon to segment information.

Affected systems

OpenProject versions prior to 17.4.0 are affected. The vulnerability is specific to the API endpoint and requires an authenticated session, so it does not affect unauthenticated users or those without any OpenProject access.

Exploitability

Exploitation requires valid OpenProject credentials (user login). No special privileges or administrator access is needed—any authenticated user can attempt to enumerate meeting agenda items and their linked work packages. The attack is straightforward: craft API requests to known or enumerated meeting IDs and observe returned work package details. The low complexity and lack of user interaction required means this presents a practical risk in multi-user deployments where internal users may have curiosity or malicious intent. The vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.

Remediation

Upgrade OpenProject to version 17.4.0 or later immediately. This version includes proper authorization enforcement on the agenda item endpoint. Verify the upgrade in your environment and confirm that work package access controls are now enforced consistently across the API. If an immediate upgrade is not possible, consider temporarily disabling or restricting API access to meeting endpoints until patching can be completed.

Patch guidance

Apply the official OpenProject update to version 17.4.0 or later. Consult the OpenProject release notes and vendor advisory to confirm any pre-upgrade steps, compatibility considerations, or breaking changes. After patching, test the endpoint with non-privileged accounts to verify that work package data from inaccessible projects is no longer disclosed.

Detection guidance

Monitor API access logs for repeated requests to `/api/v3/meetings/:meeting_id/agenda_items/:agenda_item_id` endpoints, particularly from users who do not have documented need to view specific meeting agendas. Correlate API calls with actual project access logs to identify potential reconnaissance. If you have query audit logs available, look for patterns where a user accesses meeting agenda data but has no corresponding access to the referenced work packages' parent projects. Post-patch, baseline normal API traffic to establish anomaly detection rules.

Why prioritize this

Although rated MEDIUM severity with a CVSS score of 4.3, this vulnerability warrants near-term patching because it affects information confidentiality in a core feature of OpenProject. It requires only user authentication (no privileged access) and exploitation is trivial, making it practically exploitable by insiders or compromised accounts. The risk is especially acute if your organization uses OpenProject to manage sensitive initiatives or client work. The absence from CISA's KEV list suggests active exploitation has not been widely observed, but this should not delay patching given the straightforward nature of the flaw.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a low network-based attack requiring authentication (AV:N, AC:L, PR:L) with only confidentiality impact (C:L). The score does not scale for organizational context—a team managing trade secrets or regulated client data should treat this with higher urgency than the base score alone suggests. The lack of integrity or availability impact keeps the rating in MEDIUM range, but information disclosure in a project management tool can have disproportionate business consequences.

Frequently asked questions