CVE-2026-67529

Deferred Deferred - Pending Action

Stored XSS in OpenProject Time and Cost Entries

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description

OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time_entries and GET /api/v3/cost_entries rendered _links.workPackage.title and _links.workPackage.href through associated_resource in modules/costs/lib/api/v3/time_entries/time_entry_representer.rb and modules/costs/lib/api/v3/cost_entries/cost_entry_representer.rb without checking WorkPackage.visible or view_work_packages, allowing users with view_time_entries or view_cost_entries to read private work package subjects and ids. This issue is fixed in 17.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-67529

EUVD

EUVD-2026-51292

Affected Vendors & Products

Vendor	Product	Version / Range
openproject	openproject	to 17.6.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

OpenProject before version 17.6.0 had a vulnerability in its API endpoints for time and cost entries. The endpoints exposed private work package titles and IDs through _links.workPackage.title and _links.workPackage.href without verifying user permissions. This allowed users with view_time_entries or view_cost_entries permissions to access restricted information.

Detection Guidance

This vulnerability can be detected by checking the OpenProject version. If your system is running a version prior to 17.6.0, it is vulnerable. Use commands like 'bundle exec openproject version' or check the version in the web interface under Administration > Information.

Impact Analysis

If you use OpenProject versions prior to 17.6.0, users with basic permissions could view private work package details. This could lead to unauthorized access to sensitive project information, including subjects and IDs of restricted work packages.

Compliance Impact

This vulnerability could potentially violate compliance requirements that mandate strict access controls for sensitive data, such as GDPR or HIPAA. Unauthorized exposure of private work package information may result in data breaches and non-compliance penalties.

Mitigation Strategies

Upgrade OpenProject to version 17.6.0 or later immediately. This can be done via package managers like apt or yum, or by following the official upgrade instructions from OpenProject documentation.

Hi! I’m here to help you understand CVE-2026-67529. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70