CVE-2026-67529

OpenProject prior to 17.6.0 exposes private work package details via GET /api/v3/time_entries and GET /api/v3/cost_entries. The time_entry_representer.rb and cost_entry_representer.rb modules render _links.workPackage.title and _links.workPackage.href without checking WorkPackage.visible or view_...