CVE-2026-44736

OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retrieve relations — and the subject (title) of work packages they have no permission to view — by supplying an arbitrary work package ID in the involved, fromId, or toId filter. This bypasses the Relation.visible scope due to a flawed performance optimization in RelationQuery. This vulnerability is fixed in 17.4.0.

• CWE-200
• CWE-639
• CWE-836

• https://github.com/opf/openproject/security/advisories/GHSA-p9gq-hrgh-2645
• https://github.com/opf/openproject/security/advisories/GHSA-p9gq-hrgh-2645

Published

Jun 26, 2026

Last Modified

Jun 27, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44730OpenCTI is an open source platform for managing cyber threat…7.2
• CVE-2026-44731OpenProject is open-source, web-based project management sof…4.3
• CVE-2026-44732OpenProject is open-source, web-based project management sof…4.3
• CVE-2026-44733OpenProject is open-source, web-based project management sof…5.9
• CVE-2026-44734OpenProject is open-source, web-based project management sof…6.5
• CVE-2026-44735OpenProject is open-source, web-based project management sof…6.5
• CVE-2026-44737grav-plugin-admin is the admin plugin for Grav is an HTML us…6.2
• CVE-2026-44738Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the …7.7
• CVE-2026-44739Pimcore is an Open Source Data & Experience Management Platf…8.7
• CVE-2026-4474A flaw has been found in itsourcecode University Management …6.1
• CVE-2026-44740Billy is an interface filesystem abstraction for Go. Prior t…6.5
• CVE-2026-44742Postorius through 1.3.13 does not escape HTML in the message…6.1