CVE-2026-44735: OpenProject Information Disclosure Flaw

CVE-2026-44735 Overview

CVE-2026-44735 is a broken authorization vulnerability [CWE-863] in OpenProject, an open-source, web-based project management platform. The flaw affects the GET /api/v3/shares endpoint in versions prior to 17.3.2 and 17.4.0. The endpoint returns share details for every work package in a project to any user holding the view_shared_work_packages permission. The authorization check operates only at the project level and fails to verify whether the requesting user can view each individual work package. A regular project member can enumerate work package IDs, subjects, granted users, and assigned roles.

Critical Impact
Authenticated project members can access confidential work package titles and share metadata across an entire project without per-object authorization checks.

Affected Products

OpenProject versions prior to 17.3.2
OpenProject 17.4.0 pre-release builds
OpenProject /api/v3/shares endpoint

Discovery Timeline

2026-06-26 - CVE-2026-44735 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-44735

Vulnerability Analysis

OpenProject exposes a REST endpoint at GET /api/v3/shares that lists share entries associated with work packages within a project. The endpoint enforces authorization by checking whether the caller holds the view_shared_work_packages permission at the project scope. It does not iterate through the returned share records to confirm the caller has permission to view the specific work packages referenced by those shares.

Any authenticated user with the required project-level permission can therefore query the endpoint and receive share metadata for work packages they are not otherwise authorized to see. The response reveals work package identifiers, subject lines (which frequently contain sensitive titles), the identities of users who received shared access, and the role level assigned to each share, including Editor, Commenter, or Viewer.

The issue is classified under [CWE-863] Incorrect Authorization. It requires low privileges, no user interaction, and is exploitable over the network.

Root Cause

The root cause is a missing per-object authorization check in the shares controller. Authorization is evaluated once at the project boundary rather than against each work package returned in the collection. This design assumes project-scope permission implies visibility of all contained work packages, which does not hold when work package visibility is restricted to specific members.

Attack Vector

An authenticated attacker who is a member of a target project sends a request to GET /api/v3/shares. The server returns the full set of shared work package records for the project, bypassing the per-work-package visibility rules that would normally restrict access. No exploitation tooling is required; the vulnerability is triggered by a standard authenticated API call. Refer to the GitHub Security Advisory GHSA-cfg3-f34w-9xx5 for technical details.

Detection Methods for CVE-2026-44735

Indicators of Compromise

Unusual volume of GET /api/v3/shares requests from a single authenticated session or API token
Access to work package share metadata by users who have never opened those work packages through the UI
API responses containing work package subjects that the requesting user has no direct role on

Detection Strategies

Review OpenProject application logs for GET /api/v3/shares calls and correlate the calling user against the work packages returned in each response
Alert on API clients that enumerate the shares endpoint at rates inconsistent with normal user behavior
Compare share access events against work package membership to identify authorization gaps

Monitoring Recommendations

Ingest OpenProject web server and application logs into a centralized log platform for query and alerting
Track authenticated API usage per user and flag deviations from baseline access patterns to the /api/v3/shares route
Monitor changes to project role assignments that grant the view_shared_work_packages permission

How to Mitigate CVE-2026-44735

Immediate Actions Required

Upgrade OpenProject to version 17.3.2 or 17.4.0, which contain the fix for CVE-2026-44735
Audit which users hold the view_shared_work_packages permission and remove it from roles that do not require it
Review recent access logs for the /api/v3/shares endpoint to identify possible enumeration activity

Patch Information

The vulnerability is fixed in OpenProject 17.3.2 and 17.4.0. Details are documented in the OpenProject Security Advisory GHSA-cfg3-f34w-9xx5. Administrators should apply the upgrade promptly and validate that the deployed version matches the patched release.

Workarounds

Restrict the view_shared_work_packages permission to trusted roles until the upgrade is applied
Limit project membership on projects containing sensitive work packages to reduce the pool of users able to invoke the endpoint
Place a reverse proxy rule that logs or rate-limits requests to /api/v3/shares while patching is scheduled

bash

# Configuration example
# Verify installed OpenProject version and upgrade to a fixed release
sudo openproject run bundle exec rake db:version
sudo apt-get update && sudo apt-get install --only-upgrade openproject
# Confirm the running version is 17.3.2 or 17.4.0 or later
openproject --version