OpenProject allowed authenticated non‑admin users to request /api/v3/custom_options/:id and receive the label of a CustomOption identified by a global numeric id without verifying that the option was visible to the requesting user. This improper access control permits enumeration of options belonging to admin‑only user or group custom fields, exposing sensitive data. The weakness is classified as CWE‑863 (Improper Authorization).

The affected product is OpenProject from opf. All releases earlier than version 17.6.0 are vulnerable, as the restriction on visible(custom_user) checks was not in place. Any deployment of OpenProject 17.5 or older is at risk if hosting custom fields with admin‑only visibility.

The vulnerability has a CVSS score of 4.3, indicating a medium impact. The EPSS score is less than 1 %, suggesting exploitation is unlikely but possible. It is not listed in CISA KEV. The attack requires authentication as a non‑admin user and involves sending a GET request to the /api/v3/custom_options/:id endpoint with incrementing numeric ids. Successful exploitation reveals back‑end labels of admin‑only custom fields, compromising confidentiality for that data.