CVE-2026-47193

—

CVSS 3.1

7.5 high

EPSS

<1%p36

Published

Jun 26, 2026 (Jun 26, 2026)

Modified

Jun 26, 2026

Description

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1.

Weakness: CWE-200, CWE-862
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.