{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-02T00:25:18.072","vulnerabilities":[{"cve":{"id":"CVE-2026-22605","sourceIdentifier":"security-advisories@github.com","published":"2026-01-10T02:15:49.487","lastModified":"2026-06-17T10:20:09.000","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"OpenProject is an open-source, web-based project management software. OpenProject versions prior to version 16.6.3, allowed users with the View Meetings permission on any project, to access meeting details of meetings that belonged to projects, the user does not have access to. This issue has been patched in version 16.6.3."},{"lang":"es","value":"OpenProject es un software de gestión de proyectos de código abierto y basado en la web. Las versiones de OpenProject anteriores a la versión 16.6.3 permitían a los usuarios con el permiso 'Ver reuniones' en cualquier proyecto, acceder a los detalles de reuniones que pertenecían a proyectos a los que el usuario no tenía acceso. Este problema ha sido parcheado en la versión 16.6.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"opf","product":"openproject","versions":[{"version":"< 16.6.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-01-12T19:15:19.921386Z","id":"CVE-2026-22605","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*","versionEndExcluding":"16.6.3","matchCriteriaId":"B2267B9E-E4A8-4C9D-9BEF-BE744BAEDF0E"}]}]}],"references":[{"url":"https://github.com/opf/openproject/releases/tag/v16.6.3","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/opf/openproject/security/advisories/GHSA-fq4m-pxvm-8x2j","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}}]}