Executive Summary

CVE-2026-44736 is a security vulnerability in OpenProject versions prior to 17.4.0 that affects the Relations API endpoint (/api/v3/relations). It allows any authenticated user to bypass visibility restrictions and access the subject titles of work packages they are not authorized to view by supplying arbitrary work package IDs in certain filters (involved, fromId, or toId).

This happens because of flawed filter logic in the RelationQuery class, which incorrectly skips enforcing the visibility scope when these filters are applied. Specifically, the filters only validate the visibility of the opposite side of a relation, not the user-supplied side, enabling unauthorized data exposure.

Attackers can exploit this by crafting API requests with these filters to enumerate and extract sensitive information such as project names or strategic plans in bulk.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive information within OpenProject. Authenticated users without proper permissions can access the titles of work packages and relations they should not see.

Such unauthorized access can expose confidential project details, strategic plans, or other sensitive data, potentially leading to information leakage and competitive disadvantage.

The vulnerability has a medium severity rating (CVSS 6.5) primarily due to its high confidentiality impact, although it does not affect integrity or availability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring API requests to the OpenProject server, specifically targeting the /api/v3/relations endpoint.

An authenticated user making GET requests with filters such as involved, fromId, or toId containing arbitrary work package IDs can indicate exploitation attempts.

To detect potential exploitation, you can search your web server or application logs for suspicious API calls that include these filters with unexpected or unauthorized IDs.

• Example command to search logs for suspicious API calls (assuming logs are in access.log):
• grep '/api/v3/relations' access.log | grep -E 'involved=|fromId=|toId='

Additionally, monitoring for unusual authenticated user activity querying relations they should not have access to can help identify exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade OpenProject to version 17.4.0 or later, where this vulnerability has been fixed.

If upgrading immediately is not possible, restrict access to the /api/v3/relations endpoint to only trusted users or roles that require it.

Additionally, monitor and audit API usage to detect and block suspicious requests exploiting the involved, fromId, or toId filters.

Implement network-level controls such as firewall rules or API gateways to limit access to the vulnerable endpoint.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows authenticated users to bypass visibility restrictions and access sensitive information from work packages they are not authorized to view. Such unauthorized disclosure of sensitive data can lead to non-compliance with data protection regulations like GDPR and HIPAA, which mandate strict controls on access to personal and sensitive information.

By exposing confidential project details and potentially personal data without proper authorization, the vulnerability increases the risk of data breaches and unauthorized data exposure, which are critical compliance concerns under these standards.

Useful 0 Not Useful 0