CyberRota Analysis
AI-GeneratedOpenProject versions prior to 17.6.0 are vulnerable to an enumeration issue that allows authenticated non-admin users to access and read labels of admin-only user or group custom fields via the API. This could lead to unauthorized information disclosure, potentially exposing sensitive project management data. Organizations using affected versions should prioritize upgrading to 17.6.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/custom_options/:id resolved CustomOption records by global numeric id and allowed UserCustomField and GroupCustomField options without checking visible(current_user), so authenticated non-admin users could enumerate sequential custom option ids and read labels belonging to admin_only user or group custom fields. This issue is fixed in 17.6.0.