CVE-2026-44735

{
  "id": "CVE-2026-44735",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-26T20:17:03.520",
  "lastModified": "2026-10-25T17:10:00.197",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the GET /api/v3/shares endpoint returns share details for ALL work packages in a project to any user with the view_shared_work_packages permission. The authorization check operates at the project level only — it does not verify the requesting user can actually view each individual shared work package. This allows a regular project member to discover work package IDs and subjects (including confidential titles), which users have been granted shared access, what role level was assigned (Editor, Commenter, Viewer). This vulnerability is fixed in 17.3.2 and 17.4.0."
    },
    {
      "lang": "es",
      "value": "OpenProject es un software de gestión de proyectos de código abierto y basado en la web. Antes de las versiones 17.3.2 y 17.4.0, el endpoint GET /api/v3/shares devuelve detalles de compartición para TODOS los paquetes de trabajo en un proyecto a cualquier usuario con el permiso view_shared_work_packages. La comprobación de autorización opera solo a nivel de proyecto - no verifica que el usuario solicitante pueda realmente ver cada paquete de trabajo compartido individual. Esto permite a un miembro regular del proyecto descubrir IDs y asuntos de paquetes de trabajo (incluyendo títulos confidenciales), a qué usuarios se les ha concedido acceso compartido, qué nivel de rol se asignó (Editor, Comentarista, Visor). Esta vulnerabilidad está corregida en las versiones 17.3.2 y 17.4.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "opf",
          "product": "openproject",
          "versions": [
            {
              "version": "< 17.3.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-29T15:00:12.504884Z",
          "id": "CVE-2026-44735",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/opf/openproject/security/advisories/GHSA-cfg3-f34w-9xx5",
      "source": "[email protected]"
    }
  ]
}