{"api_version":"1","generated_at":"2026-07-14T09:30:59+00:00","cve":"CVE-2026-47193","urls":{"html":"https://cve.report/CVE-2026-47193","api":"https://cve.report/api/cve/CVE-2026-47193.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-47193","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-47193"},"summary":{"title":"OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks","description":"OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1.","state":"PUBLISHED","assigner":"GitHub_M","published_at":"2026-06-26 20:17:13","updated_at":"2026-06-26 20:20:22"},"problem_types":["CWE-200","CWE-862","CWE-200 CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","CWE-862 CWE-862: Missing Authorization"],"metrics":[{"version":"3.1","source":"security-advisories@github.com","type":"Secondary","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://github.com/opf/openproject/security/advisories/GHSA-f2rx-x2qj-2hgj","name":"https://github.com/opf/openproject/security/advisories/GHSA-f2rx-x2qj-2hgj","refsource":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47193","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47193","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"opf","product":"openproject","version":"affected < 17.3.3","platforms":[]},{"source":"CNA","vendor":"opf","product":"openproject","version":"affected >= 17.4.0, < 17.4.1","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"47193","cve":"CVE-2026-47193","epss":"0.002520000","percentile":"0.164550000","score_date":"2026-06-29","updated_at":"2026-06-30 00:06:52"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-47193","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-06-26T19:42:16.926258Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-06-26T19:42:38.388Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["exploit"],"url":"https://github.com/opf/openproject/security/advisories/GHSA-f2rx-x2qj-2hgj"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"openproject","vendor":"opf","versions":[{"status":"affected","version":"< 17.3.3"},{"status":"affected","version":">= 17.4.0, < 17.4.1"}]}],"descriptions":[{"lang":"en","value":"OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","description":"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-862","description":"CWE-862: Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-06-26T19:01:09.927Z","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M"},"references":[{"name":"https://github.com/opf/openproject/security/advisories/GHSA-f2rx-x2qj-2hgj","tags":["x_refsource_CONFIRM"],"url":"https://github.com/opf/openproject/security/advisories/GHSA-f2rx-x2qj-2hgj"}],"source":{"advisory":"GHSA-f2rx-x2qj-2hgj","discovery":"UNKNOWN"},"title":"OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks"}},"cveMetadata":{"assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","assignerShortName":"GitHub_M","cveId":"CVE-2026-47193","datePublished":"2026-06-26T19:01:09.927Z","dateReserved":"2026-05-18T22:07:37.435Z","dateUpdated":"2026-06-26T19:42:38.388Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-06-26 20:17:13","lastModifiedDate":"2026-06-26 20:20:22","problem_types":["CWE-200","CWE-862","CWE-200 CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","CWE-862 CWE-862: Missing Authorization"],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-26T19:42:16.926258Z","id":"CVE-2026-47193","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"47193","Ordinal":"1","Title":"OpenProject: Journal diff endpoint bypasses object, journal, and","CVE":"CVE-2026-47193","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"47193","Ordinal":"1","NoteData":"OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1.","Type":"Description","Title":"OpenProject: Journal diff endpoint bypasses object, journal, and"}]}}}