CVE-2026-23721

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23721", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-15T15:45:01.955Z", "datePublished": "2026-01-19T17:52:35.307Z", "dateUpdated": "2026-01-20T14:51:21.936Z"}, "containers": {"cna": {"title": "OpenProject users with \"View Members\" permission in any project can view all Group memberships", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/opf/openproject/security/advisories/GHSA-vj77-wrc2-5h5h", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/opf/openproject/security/advisories/GHSA-vj77-wrc2-5h5h"}], "affected": [{"vendor": "opf", "product": "openproject", "versions": [{"version": "< 16.6.5", "status": "affected"}, {"version": "= 17.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-19T17:52:35.307Z"}, "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. When using groups in OpenProject to manage users, the group members should only be visible to users that have the View Members permission in any project that the group is also a member of. Prior to versions 17.0.1 and 16.6.5, due to a failed permission check, if a user had the View Members permission in any project, they could enumerate all Groups and view which other users are part of the group. The issue has been fixed in OpenProject 17.0.1 and 16.6.5. No known workarounds are available."}], "source": {"advisory": "GHSA-vj77-wrc2-5h5h", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T14:51:12.955677Z", "id": "CVE-2026-23721", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T14:51:21.936Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "OpenProject users with \"View Members\" permission in any project can view all Group memberships", "source": {"advisory": "GHSA-vj77-wrc2-5h5h", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "opf", "product": "openproject", "versions": [{"status": "affected", "version": "< 16.6.5"}, {"status": "affected", "version": "= 17.0.0"}]}], "references": [{"url": "https://github.com/opf/openproject/security/advisories/GHSA-vj77-wrc2-5h5h", "name": "https://github.com/opf/openproject/security/advisories/GHSA-vj77-wrc2-5h5h", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. When using groups in OpenProject to manage users, the group members should only be visible to users that have the View Members permission in any project that the group is also a member of. Prior to versions 17.0.1 and 16.6.5, due to a failed permission check, if a user had the View Members permission in any project, they could enumerate all Groups and view which other users are part of the group. The issue has been fixed in OpenProject 17.0.1 and 16.6.5. No known workarounds are available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-19T17:52:35.307Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23721", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T14:51:12.955677Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-01-20T14:51:17.311Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-23721", "state": "PUBLISHED", "dateUpdated": "2026-01-19T17:52:35.307Z", "dateReserved": "2026-01-15T15:45:01.955Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-19T17:52:35.307Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openproject", "vendor": "opf", "versions": [{"status": "affected", "version": "< 16.6.5"}, {"status": "affected", "version": "= 17.0.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*", "matchCriteriaId": "4C6FE059-AB36-4883-AE55-2E65FDE51BD2", "versionEndExcluding": "16.6.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:openproject:openproject:17.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "78FA3834-A1AB-4489-AE2A-2C7FAE9B619F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. When using groups in OpenProject to manage users, the group members should only be visible to users that have the View Members permission in any project that the group is also a member of. Prior to versions 17.0.1 and 16.6.5, due to a failed permission check, if a user had the View Members permission in any project, they could enumerate all Groups and view which other users are part of the group. The issue has been fixed in OpenProject 17.0.1 and 16.6.5. No known workarounds are available."}, {"lang": "es", "value": "OpenProject es un software de gesti\u00f3n de proyectos de c\u00f3digo abierto y basado en la web. Cuando se utilizan grupos en OpenProject para gestionar usuarios, los miembros del grupo solo deber\u00edan ser visibles para los usuarios que tienen el permiso 'Ver miembros' en cualquier proyecto del que el grupo tambi\u00e9n sea miembro. Antes de las versiones 17.0.1 y 16.6.5, debido a una comprobaci\u00f3n de permisos fallida, si un usuario ten\u00eda el permiso 'Ver miembros' en cualquier proyecto, pod\u00eda enumerar todos los Grupos y ver qu\u00e9 otros usuarios formaban parte del grupo. El problema ha sido solucionado en OpenProject 17.0.1 y 16.6.5. No se conocen soluciones alternativas disponibles."}], "id": "CVE-2026-23721", "lastModified": "2026-06-17T10:21:59.597", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23721", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T14:51:12.955677Z", "version": "2.0.3"}}]}, "published": "2026-01-19T18:16:05.730", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/opf/openproject/security/advisories/GHSA-vj77-wrc2-5h5h"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T05:06:39.284593+00:00", "value": {"mitigation_remediation": ["Update to OpenProject\u00a017.0.1 or\u00a016.6.5 (or newer) to apply the fix.", "Review user accounts to ensure that only trusted personnel are granted the View Members permission, and remove the permission from accounts that do not need it.", "Conduct an audit of group membership visibility and adjust access controls to limit exposure of member lists."], "summary": {"action": "Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "Versions of OpenProject earlier than\u00a017.0.1 and\u00a016.6.5 are affected. Users running OpenProject\u00a016.x (up to\u00a016.6.4) or\u00a017.0.0 receive the vulnerability. The issue is tied to group usage and the View Members permission across any project.", "description_and_impact": "OpenProject users who have been granted the View Members permission in any project can enumerate all groups and view the membership list of each group. The flaw is a failed permissions check that exposes group membership data that should be hidden from such users. This is an instance of missing permissions (CWE\u2011862) and enables the disclosure of user identities and group structures, potentially aiding social engineering or targeted attacks.", "risk_and_exploitability": "The vulnerability has an overall CVSS score of\u00a04.3 and an EPSS score of less than\u00a01\u00a0%. It is not listed in the CISA KEV catalog, indicating no publicly known exploits. An attacker must possess a valid account with View Members permission in at least one project; with that access, enumeration of all groups and their members is straightforward. The impact is limited to information disclosure but can aid further attacks if attacker leverages the collected data."}}}}, "created": "2026-01-20T08:40:41.330534+00:00", "updated": "2026-04-18T05:15:15.977544+00:00", "vendors": ["openproject", "openproject$PRODUCT$openproject"]}