CVE-2026-47193

OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks

CVSS 7.5 HIGHEPSS 0.3%CWE-200 CWE-862

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.5EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

26 Jun 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

opf · openproject

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/opf/openproject/security/advisories/GHSA-f2rx-x2qj-2hgj