https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T07:55:34.181091+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-55095 CVE-2026-55095 — OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields 2026-10-01T07:55:34.196774+00:00

Affected: opf openproject

OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw custom_field_ project attribute. The dialog path resolves the project custom field by its raw identifier without enforcing the normal admin_only visibility scope and renders the stored custom-field comment in read-only mode. This discloses hidden comment text but does not disclose the custom-field value or permit writes or mutation. This issue is reported as fixed in version 17.6.0.