CVE-2026-23721CWE-862

OpenProject users with "View Members" permission in any project can view all Group memberships

Medium · published January 19, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
10.5
In the wild
Unconfirmed
What it is

OpenProject is an open-source, web-based project management software. When using groups in OpenProject to manage users, the group members should only be visible to users that have the View Members permission in any project that the group is also a member of. Prior to versions 17.0.1 and 16.6.5, due to a failed permission check, if a user had the View Members permission in any project, they could enumerate all Groups and view which other users are part of the group. The issue has been fixed in OpenProject 17.0.1 and 16.6.5. No known workarounds are available.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00209 · 10.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-01-19T17:52Z
EPSS history
Timeline
  • 19 JAN 17:52Z
    OpenProject users with "View Members" permission in any project can view all Group memberships
    cvelistv5