CVE-2026-67529 json
OpenProject: Private work package subject/identity disclosure through the global Time Entries and Cost Entries APIs (linked work package rendered without visibility check)
published 3mo ago modified 19d ago also EUVD-2026-51292
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 35%
- public exploits
- 0
- none known
Summary
OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time_entries and GET /api/v3/cost_entries rendered _links.workPackage.title and _links.workPackage.href through associated_resource in modules/costs/lib/api/v3/time_entries/time_entry_representer.rb and modules/costs/lib/api/v3/cost_entries/cost_entry_representer.rb without checking WorkPackage.visible or view_work_packages, allowing users with view_time_entries or view_cost_entries to read private work package subjects and ids. This issue is fixed in 17.6.0.
Patch / fix
- openproject openproject 17.6.0
- github.com/opf/openproject@9e9e562 commit
- github.com/opf/openproject@c31c2f9 commit
- github.com/opf/openproject#23888 pull request
- github.com/opf/openproject#23936 pull request
- github.com/opf/openproject/releases/tag/v17.6.0 release
Is CVE-2026-67529 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 3mo ago
Exploit prediction
0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected products
- opf openproject
Classification
References
- github.com /opf/openproject/pull/23888
- github.com /opf/openproject/pull/23936
- github.com /opf/openproject/commit/9e9e562e516a647f35267df715d875f58b267c18
- github.com /opf/openproject/commit/c31c2f958c8e72a0d0d748d728221d57f3ef9001
- github.com /opf/openproject/security/advisories/GHSA-v3j7-vqwv-5w5q
- github.com /opf/openproject/releases/tag/v17.6.0
Sources
- CVE List CVE-2026-67529
- NVD CVE-2026-67529
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.