CVE-2026-67528
Deferred Deferred - Pending Action

Authenticated Custom Option ID Enumeration in OpenProject

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description
OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/custom_options/:id resolved CustomOption records by global numeric id and allowed UserCustomField and GroupCustomField options without checking visible(current_user), so authenticated non-admin users could enumerate sequential custom option ids and read labels belonging to admin_only user or group custom fields. This issue is fixed in 17.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-67528
EUVD
EUVD-2026-51281

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openproject openproject to 17.6.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenProject before version 17.6.0 had a flaw in the GET /api/v3/custom_options/:id endpoint. It allowed non-admin users to access CustomOption records by guessing sequential IDs, including options meant only for admin users or group custom fields. This could expose sensitive labels to unauthorized users.

Impact Analysis

If you use OpenProject versions before 17.6.0, an attacker with basic authentication could enumerate custom option IDs and view labels from admin-only fields. This may leak confidential project or user data, depending on how custom fields are configured.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) or HIPAA (health information privacy) if such data is exposed. Organizations must ensure systems are updated to mitigate compliance risks.

Mitigation Strategies

Upgrade OpenProject to version 17.6.0 or later to address the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67528. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart