Permission Check Flaw in OpenProject Affects User Group Visibility
CVE-2026-23721

4.3MEDIUM

Key Information:

Vendor

Opf

Status
Openproject
Vendor
CVE Published:
19 January 2026

What is CVE-2026-23721?

OpenProject, an open-source web-based project management software, has a vulnerability that allows users with the View Members permission to gain visibility into all groups and their members. This issue arises from a failed permission check in versions prior to 17.0.1 and 16.6.5, where users could enumerate group memberships across projects. The problem has been addressed in the aforementioned versions, and there are no known workarounds available. Proper user permission implementations are essential to safeguard sensitive group information.

Affected Version(s)

openproject < 16.6.5 < 16.6.5

openproject = 17.0.0 = 17.0.0

References

https://github.com/opf/openproject/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.