CVE-2026-47193: OpenProject Information Disclosure Flaw

CVE-2026-47193 Overview

CVE-2026-47193 is an information disclosure vulnerability in OpenProject, an open-source web-based project management platform. The journal diff endpoint returns hidden historical field values without enforcing object and field visibility controls. Unauthenticated network attackers can retrieve sensitive data that should be restricted by permission checks. The flaw is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). OpenProject resolved the issue in versions 17.3.3 and 17.4.1.

Critical Impact
Attackers can enumerate hidden historical values through the journal diff endpoint, exposing confidential project data, restricted field changes, and information intended to remain hidden from unauthorized users.

Affected Products

OpenProject versions prior to 17.3.3
OpenProject versions in the 17.4.x branch prior to 17.4.1
Self-hosted and community OpenProject deployments exposing the journal diff endpoint

Discovery Timeline

2026-06-26 - CVE-2026-47193 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-47193

Vulnerability Analysis

OpenProject records changes to work packages and other objects in journals. The journal diff endpoint returns differences between historical revisions, including field values that were modified over time. In vulnerable releases, the endpoint returns these values without re-checking whether the requesting user has permission to view the underlying object or specific fields.

The issue falls into the broken access control category. Authorization decisions applied to the primary object views are not consistently enforced on the diff response path. As a result, values that would be hidden in the standard interface leak through the historical comparison output.

The vulnerability affects confidentiality only. It does not permit modification of data or disruption of service. Attackers do not need credentials, user interaction, or elevated privileges to trigger the disclosure.

Root Cause

The root cause is missing field- and object-level visibility enforcement in the journal diff response builder. The endpoint constructs diff payloads directly from stored journal entries rather than filtering them through the same permission and visibility layer used for live object rendering.

Attack Vector

An attacker sends crafted HTTP requests to the journal diff endpoint over the network. Because privileges required are none and no user interaction is required, exploitation reduces to identifying reachable OpenProject instances and issuing requests against journaled objects. The endpoint returns historical field values that should have been filtered by the visibility layer. Refer to the GitHub Security Advisory for the vendor's technical description.

Detection Methods for CVE-2026-47193

Indicators of Compromise

Repeated HTTP requests to journal diff routes under /api/v3/ or work package activity endpoints from unauthenticated or low-privilege sessions
Anomalous response sizes from journal diff endpoints indicating disclosure of hidden field content
Bursts of sequential requests iterating journal IDs or work package IDs from a single source

Detection Strategies

Enable OpenProject access logging and monitor for unauthenticated access to journal diff routes
Correlate web server logs with application-level authorization events to identify requests that return data without a matching permission grant
Alert on user agents or IP addresses issuing high volumes of journal-related API calls in short time windows

Monitoring Recommendations

Ingest OpenProject application and reverse proxy logs into a centralized analytics platform for retention and query
Baseline normal journal diff traffic per user and flag deviations exceeding that baseline
Track outbound data volumes from OpenProject hosts to detect large-scale enumeration of historical journal content

How to Mitigate CVE-2026-47193

Immediate Actions Required

Upgrade OpenProject to version 17.3.3 or 17.4.1 immediately, depending on the deployed branch
Restrict network exposure of OpenProject instances so that only authenticated internal users can reach journal endpoints
Review access logs for suspicious requests to journal diff endpoints prior to patching

Patch Information

OpenProject fixed the vulnerability in versions 17.3.3 and 17.4.1. Administrators running any earlier release must upgrade to one of these versions. Full remediation details are available in the GitHub Security Advisory GHSA-f2rx-x2qj-2hgj.

Workarounds

Place OpenProject behind a reverse proxy or VPN that requires authentication before the application is reachable
Temporarily block requests to journal diff endpoints at the web server or WAF layer until the upgrade is applied
Limit disclosure exposure by removing or archiving sensitive historical field values from journaled objects where feasible

bash

# Example nginx rule to block journal diff paths pending patch deployment
location ~* /work_packages/[0-9]+/activity {
    return 403;
}
location ~* /api/v3/.*/journals/.*/diff {
    return 403;
}