CVE-2026-44736: Opf Openproject

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retrieve relations — and the subject (title) of work packages they have no permission to view — by supplying an arbitrary work package ID in the involved, fromId, or toId filter. This bypasses the Relation.visible scope due to a flawed performance optimization in RelationQuery. This vulnerability is fixed in 17.4.0.

Affected products

• Opf Openproject: before 17.4.0 (fixed in 17.4.0)

Published 2026-06-26. Last modified 2026-06-27.