CVE-2026-67528CWE-863broken-access-control

CVE-2026-67528

Medium · published July 31, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
28.6
In the wild
Unconfirmed
What it is

OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/custom_options/:id resolved CustomOption records by global numeric id and allowed UserCustomField and GroupCustomField options without checking visible(current_user), so authenticated non-admin users could enumerate sequential custom option ids and read labels belonging to admin_only user or group custom fields. This issue is fixed in 17.6.0.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00360 · 28.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-07-31T00:18Z
References (3)
https://github.com/opf/openproject/commit/a13fa079bc8040449570384c19f2d98f637179f1 · [email protected]https://github.com/opf/openproject/releases/tag/v17.6.0 · [email protected]https://github.com/opf/openproject/security/advisories/GHSA-wr3w-qchj-p4cm · [email protected]
EPSS history
Timeline
  • 30 JUL 19:24Z
    OpenProject: Improper Access Control through /api/v3/custom_options/:id via Path "id" leads to Sensitive Data Exposure
    cvelistv5