CVE-2026-55095: Opf Openproject

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw custom_field_ project attribute. The dialog path resolves the project custom field by its raw identifier without enforcing the normal admin_only visibility scope and renders the stored custom-field comment in read-only mode. This discloses hidden comment text but does not disclose the custom-field value or permit writes or mutation. This issue is reported as fixed in version 17.6.0.

Affected products

• Opf Openproject: before 17.6.0 (fixed in 17.6.0)

Published 2026-08-20. Last modified 2026-09-18.