OpenProject: Unauthenticated Access to User Labor Cost Rate

Summary

Prior to version 17.2.0, OpenProject allowed non-project members to see labor cost rates of other users. This could be exploited by an unauthorized user to see sensitive information. OpenProject 17.2.0 fixes this issue, so update to the latest version to ensure security.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
openproject	openproject	<= 17.2.0	–

Original title

OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when editing a project budget and planning the labor cost, it was not checked that the user that was planned i...

Original description

OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when editing a project budget and planning the labor cost, it was not checked that the user that was planned in the budget is actually a project member. This exposed the user's default rate (if one was set up) to users that should only see that information for project members. Also, the endpoint that handles the pre-calculation for the frontend to display a preview of the costs, while it was being entered, did not properly validate the membership of the user as well. This also allowed to calculate costs with the default rate of non-members. This vulnerability is fixed in 17.2.0.

nvd CVSS3.1 4.3

Vulnerability type

CWE-863 Incorrect Authorization

https://github.com/opf/openproject/security/advisories/GHSA-p747-569x-3v3f