CVE-2026-55095: Missing Authorization

OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw customfield project attribute. The dialog path resolves the project custom field by its raw identifier without...