CVE-2026-47193CWE-200CWE-862

OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks

High · published June 26, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
36.0
In the wild
Unconfirmed
What it is

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00428 · 36.0th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-862 · Missing Authorization
Published
2026-06-26T19:01Z
EPSS history
Timeline
  • 26 JUN 19:01Z
    OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks
    cvelistv5