CVE-2026-47193 | OpenProject is open-source, web-based project management sof… | CVSS 7.5 HIGH

Description

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1.

Metadata

CVE ID: CVE-2026-47193
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-05-18 22:07 UTC
Published: 2026-06-26 19:01 UTC
Last updated: 2026-06-26 19:42 UTC
Primary CWE: CWE-200
CWE-200: Exposure of Sensitive Information to an Unauthorize…
Vendor / Product: opf / openproject
Sources: cve.org · NVD

Severity & Metrics

7.5 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
opf	openproject	—	< 17.3.3, >= 17.4.0, < 17.4.1

Weakness (CWE)

CWE	Source	Description
CWE-200	cna	CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-862	cna	CWE-862: Missing Authorization

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.5	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References (1)

https://github.com/opf/openproject/security/advisories/GHSA-f2rx-x2qj-2hgj https://github.com/opf/openproject/security/advisories/GHSA-f2rx-x2qj-2hgj