---
id: CVE-2026-55095
title: 'OpenProject is open-source, web-based project management software'
summary: >-
  OpenProject is open-source, web-based project management software. In version
  17.5.1 and earlier, an authenticated non-admin project member can request the
  inplace-edit dialog for a raw custom_field_ project attribute. The dialog path
  re…
severity: none
cwe:
  - CWE-862
published: '2026-08-20'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:09:01.757'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55095'
references:
  - url: 'https://github.com/opf/openproject/releases/tag/v17.6.0'
    label: security-advisories@github.com
  - url: 'https://github.com/opf/openproject/security/advisories/GHSA-63fg-pgqj-3qf8'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00288
epssPercentile: 0.21688
ingestedAt: '2026-09-18T20:51:25.641Z'
---

## Overview

OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw custom_field_ project attribute. The dialog path resolves the project custom field by its raw identifier without enforcing the normal admin_only visibility scope and renders the stored custom-field comment in read-only mode. This discloses hidden comment text but does not disclose the custom-field value or permit writes or mutation. This issue is reported as fixed in version 17.6.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.