OpenProject users who have been granted the View Members permission in any project can enumerate all groups and view the membership list of each group. The flaw is a failed permissions check that exposes group membership data that should be hidden from such users. This is an instance of missing permissions (CWE‑862) and enables the disclosure of user identities and group structures, potentially aiding social engineering or targeted attacks.

Versions of OpenProject earlier than 17.0.1 and 16.6.5 are affected. Users running OpenProject 16.x (up to 16.6.4) or 17.0.0 receive the vulnerability. The issue is tied to group usage and the View Members permission across any project.

The vulnerability has an overall CVSS score of 4.3 and an EPSS score of less than 1 %. It is not listed in the CISA KEV catalog, indicating no publicly known exploits. An attacker must possess a valid account with View Members permission in at least one project; with that access, enumeration of all groups and their members is straightforward. The impact is limited to information disclosure but can aid further attacks if attacker leverages the collected data.