What’s Vulnerable › Vulnerabilities

CVE-2026-55095: OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields

• Severity: medium (CVSS 5.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-20 · updated 2026-10-18
• Weakness: CWE-862

Description

OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw custom_field_ project attribute. The dialog path resolves the project custom field by its raw identifier without enforcing the normal admin_only visibility scope and renders the stored custom-field comment in read-only mode. This discloses hidden comment text but does not disclose the custom-field value or permit writes or mutation. This issue is reported as fixed in version 17.6.0.

Affected products

• opf openproject: before 17.6.0

References

• https://github.com/opf/openproject/releases/tag/v17.6.0
• https://github.com/opf/openproject/security/advisories/GHSA-63fg-pgqj-3qf8

Get alerted when CVE-2026-55095 or the next vulnerability affects your stack