CVE-2026-49355 Overview
CVE-2026-49355 is an information disclosure vulnerability in OpenProject, an open-source web-based project management platform. The flaw exists in the meetings API endpoint GET /api/v3/meetings/:meeting_id/agenda_items/:agenda_item_id. This endpoint discloses private work package data from linked work packages that belong to private or otherwise inaccessible projects. Authenticated users with access to a meeting can retrieve information they should not be authorized to view. The issue is fixed in OpenProject 17.4.0 and is categorized under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Authenticated attackers can read private work package details from projects they have no membership or access rights to through the meetings agenda API.
Affected Products
- OpenProject versions prior to 17.4.0
- OpenProject Meetings module (agenda items API)
- Deployments exposing /api/v3/meetings/:meeting_id/agenda_items/:agenda_item_id
Discovery Timeline
- 2026-06-26 - CVE-2026-49355 published to NVD
- 2026-06-29 - Last updated in NVD database
Technical Details for CVE-2026-49355
Vulnerability Analysis
The vulnerability resides in the OpenProject meetings API. When a meeting agenda item links to a work package, the API endpoint returns work package attributes without re-validating the requesting user's access to the underlying project. OpenProject enforces access control at the project level, so work packages inside private projects should be invisible to non-members. The agenda item serializer bypasses this control by exposing the linked work package payload directly to any user authorized to view the meeting. The attack requires low privileges and no user interaction, and it can be executed remotely over the network. The disclosed data is limited to confidentiality impact, with no direct integrity or availability effect.
Root Cause
The root cause is a broken access control pattern [CWE-200] in the agenda item resource. The controller assumes that authorization to read a meeting transitively authorizes reading any linked resource. It does not perform a permission check against the work package's parent project before serializing sensitive fields such as subject, description, status, and custom attributes.
Attack Vector
An authenticated OpenProject user who is a participant or viewer of a meeting sends a GET request to /api/v3/meetings/:meeting_id/agenda_items/:agenda_item_id. If the referenced agenda item points to a work package inside a private project the attacker cannot otherwise reach, the response body still includes work package details. No exploitation code is required beyond a standard HTTP client with valid session credentials.
// No verified public proof-of-concept is available.
// See the GitHub Security Advisory for technical details:
// https://github.com/opf/openproject/security/advisories/GHSA-g387-6rm2-xw88
Detection Methods for CVE-2026-49355
Indicators of Compromise
- Repeated authenticated GET requests to /api/v3/meetings/:meeting_id/agenda_items/:agenda_item_id from a single user session.
- API responses returning work package fields for projects the requesting user is not a member of.
- Anomalous enumeration of sequential agenda_item_id values by non-privileged accounts.
Detection Strategies
- Review OpenProject application logs for meeting agenda API calls correlated with users lacking project membership on the linked work package.
- Baseline normal meeting API usage per user role, then alert on deviations such as high-volume agenda item lookups.
- Cross-reference API access logs with project membership data to identify authorization gaps.
Monitoring Recommendations
- Forward OpenProject Rails and web server access logs to a centralized log platform for retention and analysis.
- Alert on HTTP 200 responses to /api/v3/meetings/*/agenda_items/* where the authenticated principal is not in the linked project's member roster.
- Track user agents and IP addresses issuing enumeration patterns against agenda item identifiers.
How to Mitigate CVE-2026-49355
Immediate Actions Required
- Upgrade OpenProject to version 17.4.0 or later, which contains the official fix.
- Audit meeting participants and remove users who do not require meeting access.
- Review historical access logs for suspicious queries against the agenda items endpoint prior to patching.
Patch Information
The vulnerability is resolved in OpenProject 17.4.0. Refer to the OpenProject GitHub Security Advisory GHSA-g387-6rm2-xw88 for release notes and upgrade guidance. Administrators should apply the upgrade following OpenProject's standard deployment procedure for their installation method (Docker, package, or Helm).
Workarounds
- Restrict meeting participation to trusted users until the upgrade is deployed.
- Avoid linking work packages from confidential projects to meetings that include broader audiences.
- Place OpenProject behind a reverse proxy that can filter or rate-limit requests to the affected endpoint if immediate patching is not feasible.
# Example: verify running OpenProject version before and after upgrade
sudo openproject run bundle exec rails runner 'puts OpenProject::VERSION::STRING'
# Docker-based upgrade example
docker pull openproject/openproject:17.4.0
docker compose up -d
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
