从网页截图中获取到的关于漏洞的关键信息如下： 漏洞标题: Users with "View Members" permission in any project can view all Group memberships 严重性: Moderate (中等) CVE ID: CVE-2026-23721 影响版本 Affected versions: <= 16.6.4, 17.0.0 修复版本 Patched versions: 16.6.5, 17.0.1 漏洞描述 When using groups in OpenProject to manage users, the group members should only be visible to users that have the View Members permission in any project that the group is also a member of. - 由于权限检查失败，拥有“查看成员”权限的用户可以枚举所有组并查看其他用户所属的组。 修复措施 The issue has been fixed in OpenProject 17.0.1 and 16.6.5. CVE v3 基础指标 Attack vector: Network Attack complexity: Low Privileges required: Low User interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None