CVE-2026-49355CWE-200CWE-639

OpenProject: Private work package data disclosure through single meeting agenda item API

Medium · published June 26, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
20.8
In the wild
Unconfirmed
What it is

OpenProject is open-source, web-based project management software. Prior to 17.4.0, `GET /api/v3/meetings/:meeting_id/agenda_items/:agenda_item_id` discloses private work package data from a linked work package that belongs to a private/inaccessible project. This vulnerability is fixed in 17.4.0.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00294 · 20.8th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-06-26T19:29Z
EPSS history
Timeline
  • 26 JUN 19:29Z
    OpenProject: Private work package data disclosure through single meeting agenda item API
    cvelistv5