CVE-2026-55095
Received Received - Intake

Authenticated Non-Admin Access to Hidden Custom Field Comments in OpenProject

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw custom_field_ project attribute. The dialog path resolves the project custom field by its raw identifier without enforcing the normal admin_only visibility scope and renders the stored custom-field comment in read-only mode. This discloses hidden comment text but does not disclose the custom-field value or permit writes or mutation. This issue is reported as fixed in version 17.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-55095
EUVD
EUVD-2026-63463

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
openproject openproject to 17.6.0 (exc)
openproject openproject 17.6.0
opf openproject to 17.5.1 (inc)
opf openproject 17.6.0
opf openproject to 17.5.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects OpenProject versions up to 17.5.1. An authenticated non-admin project member can access the comment text of hidden admin-only project custom fields by exploiting the inplace-edit dialog. The dialog bypasses normal visibility restrictions by resolving the field by its raw ID and displaying the comment in read-only mode. It does not allow disclosure of hidden custom-field values or permit writes.

Detection Guidance

To detect this vulnerability, check if your OpenProject instance is running a version prior to 17.6.0. Use the command: openproject version or check the version in the web interface under Administration > Information. If the version is 17.5.1 or earlier, the system is vulnerable.

Impact Analysis

If you are a non-admin project member in OpenProject versions up to 17.5.1, this vulnerability could expose hidden comment text from admin-only custom fields. This may reveal sensitive information intended only for administrators, though it does not allow modification or access to the custom field values themselves.

Compliance Impact

This vulnerability could potentially impact compliance by exposing sensitive information stored in hidden custom field comments. If such information includes personal data protected under GDPR or HIPAA, unauthorized access may violate these regulations, leading to legal and regulatory risks.

Mitigation Strategies

Upgrade OpenProject to version 17.6.0 or later immediately. This can be done via package manager commands like apt upgrade openproject or yum update openproject depending on your system. Verify the update by checking the version again after installation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55095. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart