Vulnerability Description
OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw custom_field_ project attribute. The dialog path resolves the project custom field by its raw identifier without enforcing the normal admin_only visibility scope and renders the stored custom-field comment in read-only mode. This discloses hidden comment text but does not disclose the custom-field value or permit writes or mutation. This issue is reported as fixed in version 17.6.0.
Related Weaknesses (CWE)
References
- https://github.com/opf/openproject/releases/tag/v17.6.0
- https://github.com/opf/openproject/security/advisories/GHSA-63fg-pgqj-3qf8
FAQ
What is CVE-2026-55095?
CVE-2026-55095 is a documented vulnerability. OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw custom_field_ ...
How severe is CVE-2026-55095?
CVSS scoring is not yet available for CVE-2026-55095. Check NVD for updates.
Is there a patch for CVE-2026-55095?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.