« Volver al listado

CVE-2026-67529

Estado: AplazadaMedia (4.3)—

OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time_entries and GET /api/v3/cost_entries rendered _links.workPackage.title and _links.workPackage.href through associated_resource in modules/costs/lib/api/v3/time_entries/time_entry_representer.rb and modules/costs/lib/api/v3/cost_entries/cost_entry_representer.rb without checking WorkPackage.visible or view_work_packages, allowing users with view_time_entries or view_cost_entries to read private work package subjects and ids. This issue is fixed in 17.6.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Openproject — OpenprojectAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-67529",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-67529",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-31T14:37:45.456126Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "opf",
          "product": "openproject",
          "versions": [
            {
              "status": "affected",
              "version": "< 17.6.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-07-30T20:18:14.750",
  "references": [
    {
      "url": "https://github.com/opf/openproject/commit/9e9e562e516a647f35267df715d875f58b267c18",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/opf/openproject/commit/c31c2f958c8e72a0d0d748d728221d57f3ef9001",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/opf/openproject/pull/23888",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/opf/openproject/pull/23936",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/opf/openproject/releases/tag/v17.6.0",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/opf/openproject/security/advisories/GHSA-v3j7-vqwv-5w5q",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time_entries and GET /api/v3/cost_entries rendered _links.workPackage.title and _links.workPackage.href through associated_resource in modules/costs/lib/api/v3/time_entries/time_entry_representer.rb and modules/costs/lib/api/v3/cost_entries/cost_entry_representer.rb without checking WorkPackage.visible or view_work_packages, allowing users with view_time_entries or view_cost_entries to read private work package subjects and ids. This issue is fixed in 17.6.0."
    }
  ],
  "lastModified": "2026-07-31T15:18:01.293",
  "sourceIdentifier": "security-advisories@github.com"
}