VulnerabilityDeferred

CVE-2026-47193

Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility.

HIGH 7.5EPSS 0.43%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.43%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.43% probability · 36th percentile
CISA KEV: Not listed
Weakness: CWE-200, CWE-862
Source: security-advisories@github.com

References

https://github.com/opf/openproject/security/advisories/GHSA-f2rx-x2qj-2hgj
https://github.com/opf/openproject/security/advisories/GHSA-f2rx-x2qj-2hgj

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.