CVE-2026-49355— OpenProject: Private work package data disclosure through single meeting agenda item API
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| opf | openproject | < 17.4.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-49355
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenProject: Private work package data disclosure through single meeting agenda item API
Source: NVD (National Vulnerability Database)
Vulnerability Description
OpenProject is open-source, web-based project management software. Prior to 17.4.0, `GET /api/v3/meetings/:meeting_id/agenda_items/:agenda_item_id` discloses private work package data from a linked work package that belongs to a private/inaccessible project. This vulnerability is fixed in 17.4.0.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
信息暴露
Source: NVD (National Vulnerability Database)
Vulnerability Title
OPF OpenProject 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
opf openproject是opf的项目管理软件。 OPF OpenProject 17.4.0之前版本存在安全漏洞，该漏洞源于API接口`GET /api/v3/meetings/:meeting_id/agenda_items/:agenda_item_id`泄露来自私有/不可访问项目中链接工作包的私有工作包数据，可能导致信息泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| opf | openproject | < 17.4.0 | - |
II. Public POCs for CVE-2026-49355
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-49355
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-49355 (1)
Same Patch Batch · opf · 2026-06-26 · 17 CVEs total
| CVE-2026-52782 | 9.9 CRITICAL | OpenProject: IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH para |
| CVE-2026-52785 | 9.9 CRITICAL | OpenProject: SQL injection in timestamps functionality |
| CVE-2026-46386 | 9.9 CRITICAL | OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `S |
| CVE-2026-52780 | 9.6 CRITICAL | OpenProject: Cache store poisoning leads to Remote Code Execution (RCE) |
| CVE-2026-52784 | 8.8 HIGH | OpenProject: CSRF on TARGET through /users/:id via POST parameter "user[admin]" |
| CVE-2026-52783 | 8.2 HIGH | OpenProject: Information Disclosure (cleartext storage of data) on localhost through memca |
| CVE-2026-47193 | 7.5 HIGH | OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks |
| CVE-2026-44734 | 6.5 MEDIUM | OpenProject: Improper Access Control on OpenProject through the POST request to /projects/ |
| CVE-2026-44736 | 6.5 MEDIUM | OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Pa |
| CVE-2026-44735 | 6.5 MEDIUM | OpenProject: Shares API Information Disclosure |
| CVE-2026-52781 | 6.4 MEDIUM | OpenProject: Stored XSS on openproject.example.com through /api/v3/projects/{project}/work |
| CVE-2026-44733 | 5.9 MEDIUM | OpenProject: Business Logic Error on OpenProject through PATCH request to /api/v3/users/me |
| CVE-2026-44696 | 5.7 MEDIUM | OpenProject: Stored CSS injection via Sanitize::Config::RELAXED[:css] enables phishing ove |
| CVE-2026-52779 | 5.4 MEDIUM | OpenProject: Cross-project authorization bypass allows deleting public Calendar and Team P |
| CVE-2026-44731 | 4.3 MEDIUM | OpenProject: Improper Access Control on OpenProject through /projects/[projectName]/meetin |
| CVE-2026-44732 | 4.3 MEDIUM | OpenProject: IDOR on OpenProject through /api/v3/documents/{id} via PATCH parameter "proje |
IV. Related Vulnerabilities
Same product: openproject
- CVE-2026-44733
OpenProject: Business Logic Error on OpenProject through PAT - CVE-2026-44731
OpenProject: Improper Access Control on OpenProject through - CVE-2026-44732
OpenProject: IDOR on OpenProject through /api/v3/documents/{ - CVE-2026-44734
OpenProject: Improper Access Control on OpenProject through - CVE-2026-44735
OpenProject: Shares API Information Disclosure
Same vendor: opf
- CVE-2026-44733
OpenProject: Business Logic Error on OpenProject through PAT - CVE-2026-44731
OpenProject: Improper Access Control on OpenProject through - CVE-2026-44732
OpenProject: IDOR on OpenProject through /api/v3/documents/{ - CVE-2026-44734
OpenProject: Improper Access Control on OpenProject through - CVE-2026-44735
OpenProject: Shares API Information Disclosure
Same weakness: CWE-200
- CVE-2026-61454
Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__ - CVE-2026-61426
PraisonAI before 1.7.3 Unauthenticated Agent Access via Inse - CVE-2026-56303
Capgo - Unauthenticated API Key Metadata Disclosure via SECU - CVE-2026-6801
Context Blog <= 1.3.5 - Unauthenticated Sensitive Informatio - CVE-2026-10865
Cost Calculator Builder <= 4.0.11 - Unauthenticated Sensitiv
V. Comments for CVE-2026-49355
No comments yet