Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time_entries and GET /api/v3/cost_entries rendered _links.workPackage.title and _links.workPackage.href through associated_resource in modules/costs/lib/api/v3/time_entries/time_entry_representer.rb and modules/costs/lib/api/v3/cost_entries/cost_entry_representer.rb without checking WorkPackage.visible or view_work_packages, allowing users with view_time_entries or view_cost_entries to read private work package subjects and ids. This issue is fixed in 17.6.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-67529 OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time_entries and GET /api/v3/cost_entries rendered _links.workPackage.… https://www.cve.org/CVERecord?id=CVE-2026-67529
Post summary
The text briefly mentions CVE-2026-67529, provides some technical details about exposed API endpoints, but does not discuss a PoC, exploit, active use, patch, or debunking.
New CVE-2026-67529. OpenProject (≤ 17.5.1). The Time Entries and Cost Entries APIs rendered a linked work package's subject + id with no visibility check. So a user with view_time_entries but not view_work_packages could read titles/ids of work packages the direct API 404s on. https://t.co/o5bI03orWi
Post summary
A new vulnerability (CVE-2026-67529) in OpenProject allows users with limited permissions to view work package IDs via Time Entries and Cost Entries APIs, highlighting a privilege escalation flaw.