OpenProject is an open‑source, web‑based project management platform. Prior to version 17.4.0 the API endpoint GET /api/v3/meetings/:meeting_id/agenda_items/:agenda_item_id retrieves data that belongs to a linked work package. When that work package is part of a private or otherwise inaccessible project, the endpoint discloses private work package details that should not be visible to the requester. The flaw manifests as a data exposure weakness (CWE‑200) and improper authorization (CWE‑639), allowing an attacker who can invoke the API to view confidential project information.

The affected product is OpenProject, released by opf. All versions older than 17.4.0 are vulnerable; version 17.4.0 and later contain the fix. The issue arises when a user accesses data from a private project that should be beyond their access scope.

The CVSS base score is 4.3, indicating a moderate level of risk. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via the web API; an unauthenticated or minimally privileged user can exploit the endpoint to extract private work package data if they know or can guess a meeting and agenda item ID and have API access.