The journal diff endpoint in OpenProject, when accessed, does not honor object, journal, or field visibility checks, allowing an attacker to read hidden historical field values. This results in inadvertent disclosure of confidential or sensitive information that the application intended to protect, representing an information‑exposure vulnerability. The weakness is confirmed by CWE‑200 (Information Exposure) and CWE‑862 (Missing Authorization).

OpenProject versions prior to 17.3.3 and 17.4.1 are affected. The vulnerability exists in the open-source, web‑based project management product maintained by OpenProject. Users running those unpatched releases are at risk.

The CVSS score of 7.5 indicates a high severity. EPSS data is not available, so the current probability of exploitation is unknown, but the issue is not listed in the CISA KEV catalog. The likely attack vector is a remote web request to the journal diff endpoint, which an attacker can craft with appropriate authentication or, if authentication is bypassed, potentially any logged‑in user. Because the exposure is not mitigated by visibility rules, the breach can affect all users with access to the endpoint and reveal sensitive historical data.