OpenProject versions before 16.6.3 allow any user who has the View Meetings permission in a project to view the details of meetings belonging to projects that the user does not have access to. The vulnerability is an Insecure Direct Object Reference (CWE‑284), which permits unauthorized disclosure of meeting information.

The affected products are OpenProject itself. All installations running OpenProject before version 16.6.3 are susceptible, regardless of minor patch levels. Users of the open‑source project management application should check their installed version and apply the recommended upgrade if they are on any earlier release.

The CVSS score of 4.3 indicates a moderate risk level. The EPSS score of <1% shows a low likelihood that the vulnerability is being actively exploited, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated account that possesses the View Meetings privilege; once accessed, the attacker can retrieve meeting metadata and potentially sensitive content belonging to other projects.