{"id":"CVE-2026-44736","aliases":["EUVD-2026-39876","GHSA-p9gq-hrgh-2645"],"status":"published","title":"OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects","description":"OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retrieve relations — and the subject (title) of work packages they have no permission to view — by supplying an arbitrary work package ID in the involved, fromId, or toId filter. This bypasses the Relation.visible scope due to a flawed performance optimization in RelationQuery. This vulnerability is fixed in 17.4.0.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00356,"percentile":0.29584,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200","CWE-639","CWE-836"],"published":"2026-06-26T19:27:54Z","modified":"2026-10-28T02:30:45Z","products":[{"vendor":"opf","product":"openproject"}],"references":[{"url":"https://github.com/opf/openproject/security/advisories/GHSA-p9gq-hrgh-2645","tags":["x_refsource_CONFIRM","exploit","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44736.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44736","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-44736","title":"OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects","description":"OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retrieve relations — and the subject (title) of work packages they have no permission to view — by supplying an arbitrary work package ID in the involved, fromId, or toId filter. This bypasses the Relation.visible scope due to a flawed performance optimization in RelationQuery. This vulnerability is fixed in 17.4.0.","status":"published","published":"2026-06-26T19:27:54.656Z","modified":"2026-06-27T03:01:24.107Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200","CWE-639","CWE-836"],"updated_at":"2026-11-02T13:42:49.132798Z"}],"euvd":[{"id":"EUVD-2026-39876","description":"OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retrieve relations — and the subject (title) of work packages they have no permission to view — by supplying an arbitrary work package ID in the involved, fromId, or toId filter. This bypasses the Relation.visible scope due to a flawed performance optimization in RelationQuery. This vulnerability is fixed in 17.4.0.","status":"published","published":"2026-06-26T19:27:54Z","modified":"2026-06-27T03:01:24Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:23.728044Z"}],"nvd":[{"id":"CVE-2026-44736","description":"OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retrieve relations — and the subject (title) of work packages they have no permission to view — by supplying an arbitrary work package ID in the involved, fromId, or toId filter. This bypasses the Relation.visible scope due to a flawed performance optimization in RelationQuery. This vulnerability is fixed in 17.4.0.","status":"published","published":"2026-06-26T20:17:03.657Z","modified":"2026-10-25T17:10:00.197Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200","CWE-639","CWE-836"],"updated_at":"2026-11-02T14:12:26.045561Z"}],"osv":[{"id":"CVE-2026-44736","title":"OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects","description":"OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retrieve relations — and the subject (title) of work packages they have no permission to view — by supplying an arbitrary work package ID in the involved, fromId, or toId filter. This bypasses the Relation.visible scope due to a flawed performance optimization in RelationQuery. This vulnerability is fixed in 17.4.0.","status":"published","published":"2026-06-26T19:27:54.656Z","modified":"2026-10-28T02:30:45.796176929Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-639","CWE-836"],"updated_at":"2026-11-02T15:45:05.172514Z"}]}}