The vulnerability in OpenProject allows an attacker who can authenticate to the system and has the view_time_entries or view_cost_entries permission to read private work package titles and identifiers via the global Time Entries and Cost Entries API endpoints. This lack of visibility checks results in information exposure (CWE-200) and an authorization bypass (CWE-862). The attacker may learn sensitive project details, such as task names and internal IDs, that should be restricted to authorized personnel only.

Affected systems include deployments of OpenProject with version numbers prior to 17.6.0. The issue resides in the API representers located in modules/costs/lib/api/v3/time_entries/time_entry_representer.rb and modules/costs/lib/api/v3/cost_entries/cost_entry_representer.rb, which fail to enforce WorkPackage.visible or view_work_packages checks before rendering the work package subject and href. All earlier releases are potentially impacted until the patch is applied.

Risk assessment reflects a CVSS score of 4.3, indicating low to moderate severity. The EPSS score of less than 1% indicates a very low probability of widespread exploitation, and the vulnerability is not listed in CISA KEV, suggesting limited publicly known exploitation. Nevertheless, because the flaw requires authenticated access, the presence of impacted users who possess the relevant permissions increases the potential reach. Administrators should treat this as a moderate information disclosure risk and address it promptly, especially where sensitive project data is at stake.