CVE-2026-44735— OpenProject: Shares API Information Disclosure
Possible ATT&CK Techniques 1AI
T1005 · Data from Local SystemAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| opf | openproject | < 17.3.2 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-44735
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenProject: Shares API Information Disclosure
Source: NVD (National Vulnerability Database)
Vulnerability Description
OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the GET /api/v3/shares endpoint returns share details for ALL work packages in a project to any user with the view_shared_work_packages permission. The authorization check operates at the project level only — it does not verify the requesting user can actually view each individual shared work package. This allows a regular project member to discover work package IDs and subjects (including confidential titles), which users have been granted shared access, what role level was assigned (Editor, Commenter, Viewer). This vulnerability is fixed in 17.3.2 and 17.4.0.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制不正确
Source: NVD (National Vulnerability Database)
Vulnerability Title
OPF OpenProject 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
opf openproject是opf的项目管理软件。 OPF OpenProject 17.3.2之前版本存在授权问题漏洞，该漏洞源于授权检查仅在项目级别进行，未验证用户是否有权查看每个共享工作包，可能导致具有view_shared_work_packages权限的用户发现工作包ID和主题（包括机密标题）、共享访问用户及角色级别。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| opf | openproject | < 17.3.2 | - |
II. Public POCs for CVE-2026-44735
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-44735
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-44735 (1)
Same Patch Batch · opf · 2026-06-26 · 17 CVEs total
| CVE-2026-52782 | 9.9 CRITICAL | OpenProject: IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH para |
| CVE-2026-52785 | 9.9 CRITICAL | OpenProject: SQL injection in timestamps functionality |
| CVE-2026-46386 | 9.9 CRITICAL | OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `S |
| CVE-2026-52780 | 9.6 CRITICAL | OpenProject: Cache store poisoning leads to Remote Code Execution (RCE) |
| CVE-2026-52784 | 8.8 HIGH | OpenProject: CSRF on TARGET through /users/:id via POST parameter "user[admin]" |
| CVE-2026-52783 | 8.2 HIGH | OpenProject: Information Disclosure (cleartext storage of data) on localhost through memca |
| CVE-2026-47193 | 7.5 HIGH | OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks |
| CVE-2026-44734 | 6.5 MEDIUM | OpenProject: Improper Access Control on OpenProject through the POST request to /projects/ |
| CVE-2026-44736 | 6.5 MEDIUM | OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Pa |
| CVE-2026-52781 | 6.4 MEDIUM | OpenProject: Stored XSS on openproject.example.com through /api/v3/projects/{project}/work |
| CVE-2026-44733 | 5.9 MEDIUM | OpenProject: Business Logic Error on OpenProject through PATCH request to /api/v3/users/me |
| CVE-2026-44696 | 5.7 MEDIUM | OpenProject: Stored CSS injection via Sanitize::Config::RELAXED[:css] enables phishing ove |
| CVE-2026-52779 | 5.4 MEDIUM | OpenProject: Cross-project authorization bypass allows deleting public Calendar and Team P |
| CVE-2026-49355 | 4.3 MEDIUM | OpenProject: Private work package data disclosure through single meeting agenda item API |
| CVE-2026-44731 | 4.3 MEDIUM | OpenProject: Improper Access Control on OpenProject through /projects/[projectName]/meetin |
| CVE-2026-44732 | 4.3 MEDIUM | OpenProject: IDOR on OpenProject through /api/v3/documents/{id} via PATCH parameter "proje |
IV. Related Vulnerabilities
Same product: openproject
- CVE-2026-44733
OpenProject: Business Logic Error on OpenProject through PAT - CVE-2026-44731
OpenProject: Improper Access Control on OpenProject through - CVE-2026-44732
OpenProject: IDOR on OpenProject through /api/v3/documents/{ - CVE-2026-44734
OpenProject: Improper Access Control on OpenProject through - CVE-2026-44696
OpenProject: Stored CSS injection via Sanitize::Config::RELA
Same vendor: opf
- CVE-2026-44733
OpenProject: Business Logic Error on OpenProject through PAT - CVE-2026-44731
OpenProject: Improper Access Control on OpenProject through - CVE-2026-44732
OpenProject: IDOR on OpenProject through /api/v3/documents/{ - CVE-2026-44734
OpenProject: Improper Access Control on OpenProject through - CVE-2026-44696
OpenProject: Stored CSS injection via Sanitize::Config::RELA
Same weakness: CWE-863
- CVE-2026-14716
nextlevelbuilder GoClaw WebSocket RPC router.go MethodRouter - CVE-2026-28744
Gitea Git smart HTTP bypasses repository token scopes for be - CVE-2026-27780
Gitea pre-receive hook can miss branch-protection checks aft - CVE-2026-27761
Gitea repository feeds bypass API token scope enforcement - CVE-2026-27775
Gitea pre-receive hook permission cache allows full reposito
V. Comments for CVE-2026-44735
No comments yet