CyberRota Analysis
AI-GeneratedOpenProject versions 17.5.1 and earlier are vulnerable to an information disclosure issue where authenticated non-admin project members can access the inplace-edit dialog for a custom field, revealing hidden comments without proper visibility restrictions. While the vulnerability does not allow for modification of data, it exposes sensitive information that could be leveraged for social engineering or other malicious activities. Organizations using affected versions should prioritize updating to version 17.6.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw custom_field_ project attribute. The dialog path resolves the project custom field by its raw identifier without enforcing the normal admin_only visibility scope and renders the stored custom-field comment in read-only mode. This discloses hidden comment text but does not disclose the custom-field value or permit writes or mutation. This issue is reported as fixed in version 17.6.0.