The vulnerability resides in the GET /api/v3/shares endpoint of OpenProject, which returns share details for all work packages within a project to any user with the view_shared_work_packages permission. The authorization check only verifies project-level access and does not confirm whether the user can view each individual shared work package. This denial‑of‑authorization flaw corresponds to CWE‑863. Consequently, a regular project member can discover work package identifiers, confidential subject titles, and the roles (Editor, Commenter, Viewer) assigned to each share, exposing sensitive project information. The flaw was addressed in OpenProject 17.3.2 and 17.4.0.

All instances of OpenProject older than version 17.3.2 or 17.4.0, which were affected by this issue. The affected product is the web‑based project management tool OpenProject provided by opf:openproject.

The CVSS score of 6.5 indicates a moderate severity data disclosure risk. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalogue. The likely attack vector is a legitimate user with view_shared_work_packages permission accessing the unfiltered API endpoint; no special conditions or elevated privileges are required beyond normal project membership.