SEPTEMBER 19, 2026
Live Feed
Back to database
Case File

CVE-2026-67528

MEDIUM · CVSS 4.3 EPSS 0.21% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-30 · Last synced 2026-08-29

CyberRota Analysis

AI-Generated

OpenProject versions prior to 17.6.0 are vulnerable to an enumeration issue that allows authenticated non-admin users to access and read labels of admin-only user or group custom fields via the API. This could lead to unauthorized information disclosure, potentially exposing sensitive project management data. Organizations using affected versions should prioritize upgrading to 17.6.0 to mitigate this risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-67528
Severity
MEDIUM
CVSS
4.3
EPSS
0.21%

Original NVD Description

OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/custom_options/:id resolved CustomOption records by global numeric id and allowed UserCustomField and GroupCustomField options without checking visible(current_user), so authenticated non-admin users could enumerate sequential custom option ids and read labels belonging to admin_only user or group custom fields. This issue is fixed in 17.6.0.