OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects_CVE-2026-44736

{
    "lastseen": "",
    "description": "OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retrieve relations \u2014 and the subject (title) of work packages they have no permission to view \u2014 by supplying an arbitrary work package ID in the involved, fromId, or toId filter. This bypasses the Relation.visible scope due to a flawed performance optimization in RelationQuery. This vulnerability is fixed in 17.4.0.",
    "published": "2026-06-26T19:27:54.656Z",
    "modified": "2026-06-26T19:27:54.656Z",
    "type": "cve",
    "title": "OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects",
    "source": "GitHub_M",
    "references": "https://github.com/opf/openproject/security/advisories/GHSA-p9gq-hrgh-2645",
    "id": "CVE-2026-44736",
    "bulletinFamily": "",
    "cwe": [
        "CWE-200",
        "CWE-639",
        "CWE-836"
    ],
    "cvelist": null,
    "sourceData": "opf openproject < 17.4.0",
    "sourceHref": "",
    "cvss": {
        "score": 6.5,
        "severity": "MEDIUM",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "openproject",
    "version": "< 17.4.0",
    "vendor": "opf",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}