EUVD-2026-51281

OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/customoptions/:id resolved CustomOption records by global numeric id and allowed UserCustomField and GroupCustomField options without checking visiblecurrentuser, so authenticated non-admin users could...

CVE-2023-5117

CVE-2023-5117 affects GitLab CE/EE prior to 17.6.0. The issue allows access to files uploaded to comments on confidential issues and epics of public projects via a direct URL without authentication. The description in connected sources confirms the affected product family and the vulnerability me...