Beveiligingsadvies

CVE-2026-44736

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-06-26 19:27:54

Laatst bijgewerkt 2026-06-27 03:01:24

Toegewezen door GitHub_M

CVSS-score 6.5

Status PUBLISHED

Beschrijving

OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retrieve relations — and the subject (title) of work packages they have no permission to view — by supplying an arbitrary work package ID in the involved, fromId, or toId filter. This bypasses the Relation.visible scope due to a flawed performance optimization in RelationQuery. This vulnerability is fixed in 17.4.0.

← Alle CVE's bekijken Bekijk op cve.org ↗