CVE-2026-55095
2026-08-20
17h18 +00:00
17h18 +00:00
指定 CVE 通知
随时了解指定 CVE 的变更。
CVE 描述
OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw custom_field_ project attribute. The dialog path resolves the project custom field by its raw identifier without enforcing the normal admin_only visibility scope and renders the stored custom-field comment in read-only mode. This discloses hidden comment text but does not disclose the custom-field value or permit writes or mutation. This issue is reported as fixed in version 17.6.0.
CVE 信息
相关弱点
| 弱点名称 | 来源 | |
|---|---|---|
| Missing Authorization The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
