OpenProject Default Rate Exposure Vulnerability for Non-Members in Labor Budget Planning

A vulnerability in OpenProject prior to version 17.2.0 allows users to access the default labor rate of non-project members when planning project budgets. The issue arises because the software fails to verify whether a user is a project member before allowing their default rate to be used in budget calculations. This flaw also affects the cost pre-calculation endpoint, which does not properly validate user membership, enabling the use of non-member rates in cost estimates.

Impact

Exploitation of this vulnerability could lead to unauthorized access to default labor rates of users who are not project members, allowing for potential misuse of this information in budget planning.

Remediation

Users can upgrade to OpenProject version 17.2.0 or later to address this vulnerability.