CVE-2026-44736 Overview
CVE-2026-44736 is an information disclosure vulnerability in OpenProject, an open-source, web-based project management platform. The flaw resides in the GET /api/v3/relations endpoint, where authenticated users can enumerate work package relations and retrieve the subject (title) of work packages they lack permission to view. The endpoint fails to enforce the Relation.visible scope when filters such as involved, fromId, or toId are supplied with arbitrary work package IDs. The issue affects OpenProject versions prior to 17.4.0 and is tracked under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].
Critical Impact
Any authenticated OpenProject user can extract titles and relationship metadata of restricted work packages by querying the relations API with arbitrary work package identifiers.
Affected Products
- OpenProject versions prior to 17.4.0
- OpenProject Community Edition
- OpenProject Enterprise Edition (self-hosted and cloud deployments running affected versions)
Discovery Timeline
- 2026-06-26 - CVE-2026-44736 published to the National Vulnerability Database
- 2026-06-27 - Last updated in NVD database
Technical Details for CVE-2026-44736
Vulnerability Analysis
The vulnerability affects the GET /api/v3/relations endpoint in OpenProject. Authenticated users can supply arbitrary work package IDs to the involved, fromId, or toId query filters. The API returns matching relation records along with the subject field of related work packages, regardless of the requesting user's project or work package permissions. This exposes titles that often reveal sensitive project names, client identifiers, security incident references, or internal initiative codenames.
Exploitation requires only a low-privileged authenticated account. An attacker can iterate through sequential work package IDs to enumerate the complete graph of relations and their subjects across the instance. The disclosure is limited to relation metadata and titles, with no direct integrity or availability impact.
Root Cause
The root cause is a flawed performance optimization in RelationQuery. The optimization bypasses the Relation.visible scope that normally restricts result sets to relations tied to work packages the user is authorized to see. Because the visibility scope is skipped when the filter arguments are provided directly, authorization is not evaluated against the target work package IDs.
Attack Vector
An authenticated attacker sends a crafted request to /api/v3/relations with a filter parameter referencing a restricted work package ID. The server responds with relation objects that include the subject field of the referenced work package. Automating this request across an ID range yields a catalog of internal work package titles and their inter-relationships. See the OpenProject GitHub Security Advisory GHSA-p9gq-hrgh-2645 for technical details.
Detection Methods for CVE-2026-44736
Indicators of Compromise
- High volume of GET /api/v3/relations requests from a single authenticated session, especially with sequential values in involved, fromId, or toId filters.
- API responses returning work package subjects for user accounts that have no corresponding project membership.
- Unusual API access patterns from service accounts or low-privilege users outside expected working hours.
Detection Strategies
- Enable OpenProject request logging and inspect access logs for repeated queries against /api/v3/relations with varying filter IDs.
- Correlate authenticated user identity with project membership to flag relations queries that reference work packages outside the user's authorized scope.
- Alert on API clients issuing enumeration patterns such as monotonically increasing fromId or toId values within short time windows.
Monitoring Recommendations
- Forward web server and OpenProject application logs to a centralized SIEM or data lake for retention and correlation.
- Track per-user API request rates against the relations endpoint and baseline normal usage to detect deviations.
- Review audit trails for accounts that queried the relations API prior to upgrading to version 17.4.0.
How to Mitigate CVE-2026-44736
Immediate Actions Required
- Upgrade OpenProject to version 17.4.0 or later, which restores the Relation.visible scope enforcement.
- Audit application logs for prior access to /api/v3/relations with suspicious filter values.
- Rotate API tokens for accounts that may have been abused to enumerate relations.
Patch Information
The vulnerability is fixed in OpenProject 17.4.0. The fix restores authorization checks in RelationQuery so that the visibility scope is applied when involved, fromId, or toId filters are used. Refer to the OpenProject GitHub Security Advisory GHSA-p9gq-hrgh-2645 for release notes and upgrade instructions.
Workarounds
- If immediate patching is not possible, restrict access to the /api/v3/relations endpoint at the reverse proxy or web application firewall layer for untrusted user groups.
- Limit account provisioning to trusted users and disable self-registration until the upgrade is complete.
- Review sensitive work package titles and rename any that reveal confidential information until the patched version is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
