Vulnerability · Published Jun 26, 2026 · Assigned by GitHub_M
CVE-2026-47193OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks
High 7.5
In plain English
A high-severity information exposure in openproject from opf. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 75.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| opf | openproject | < 17.3.3>= 17.4.0, < 17.4.1 |
Weakness: CWE-200, CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/opf/openproject/security/advisories/GHSA-f2rx-x2qj-2hgj x_refsource_CONFIRM