Authorization Flaw in OpenProject Project Management Software
CVE-2026-44735

6.5MEDIUM

Key Information:

Vendor

Opf

Status
Openproject
Vendor
CVE Published:
26 June 2026

What is CVE-2026-44735?

OpenProject, an open-source web-based project management software, has a vulnerability in its API. The GET /api/v3/shares endpoint reveals share details for all work packages within a project to any user possessing the view_shared_work_packages permission. This loophole stems from a flawed authorization check that limits verification to the project level, neglecting to confirm the user's rights to view individual shared work packages. Consequently, this oversight can expose sensitive information, including work package IDs, titles, and assigned roles, to unauthorized users. The vulnerability has been addressed in releases 17.3.2 and 17.4.0.

Affected Version(s)

openproject < 17.3.2

References

https://github.com/opf/openproject/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.