Opf Openproject vulnerabilities

CVE-2026-30234 [MEDIUM] CWE-22 CVE-2026-30234: OpenProject is an open-source, web-based project management software. Prior to 17.2.0, an authentica OpenProject is an open-source, web-based project management software. Prior to 17.2.0, an authenticated project member with BCF import permissions can upload a crafted .bcf archive where the value in markup.bcf is manipulated to contain an absolute or traversal local path (for example: /etc/passwd or ../../../../etc/passwd). During import, this untru

CVE-2026-44734 [MEDIUM] CWE-862 CVE-2026-44734: OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, a Mis OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, a Missing Authorization vulnerability exists in OpenProject's CostReportsController. The rename and update actions allow any authenticated user to modify the name, filters, and grouping of any Public cost report in the system without verifying ownership or

CVE-2026-40896 [HIGH] CWE-367 CVE-2026-40896: OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user w OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with `manage_agendas` permission in any project can inject agenda items into meetings belonging to any other project on the instance — even projects they have no access to. No knowledge of the target project, meeting, or victim is required; the attacker

CVE-2026-44736 [MEDIUM] CWE-200 CVE-2026-44736: OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/ OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retrieve relations — and the subject (title) of work packages they have no permission to view — by supplying an arbitrary work package ID in the involved, fromId, or toId filter. This bypasses the Re

CVE-2026-44735 [MEDIUM] CWE-863 CVE-2026-44735: OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the G OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the GET /api/v3/shares endpoint returns share details for ALL work packages in a project to any user with the view_shared_work_packages permission. The authorization check operates at the project level only — it does not verify the requesting user can actu

CVE-2026-30239 [HIGH] CWE-863 CVE-2026-30239: OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when budgets OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when budgets are deleted, the work packages that were assigned to this budget need to be moved to a different budget. This action was performed before the permission check on the delete action was executed. This allowed all users in the application to delete work pac

CVE-2023-31140 [MEDIUM] CWE-613 CVE-2023-31140: OpenProject is open source project management software. Starting with version 7.4.0 and prior to ver OpenProject is open source project management software. Starting with version 7.4.0 and prior to version 12.5.4, when a user registers and confirms their first two-factor authentication (2FA) device for an account, existing logged in sessions for that user account are not terminated. Likewise, if an administrators creates a mobile phone 2FA device o

CVE-2026-30235 [MEDIUM] CWE-79 CVE-2026-30235: OpenProject is an open-source, web-based project management software. Prior to 17.2.0, this vulnerab OpenProject is an open-source, web-based project management software. Prior to 17.2.0, this vulnerability occurs due to improper validation of OpenProject’s Markdown rendering, specifically in the hyperlink handling. This allows an attacker to inject malicious hyperlink payloads that perform DOM clobbering. DOM clobbering can crash or blank the entir

CVE-2026-52781 [MEDIUM] CWE-79 CVE-2026-52781: OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the H OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the HTML sanitizer grants elements unrestricted data-* attributes via :data wildcard. An attacker injects data-controller="poll-for-changes" into a work package description, causing Stimulus.js to mount a controller that fetches an attacker-uploaded attachm

CVE-2026-44733 [MEDIUM] CWE-620 CVE-2026-44733: OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, Busin OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass password requirements. A password validation flaw in the change password behavior allows attackers to change a user's password only with an active session takeo

CVE-2026-24777 [MEDIUM] CWE-862 CVE-2026-24777: OpenProject is an open-source, web-based project management software. Prior to 17.0.2, users with th OpenProject is an open-source, web-based project management software. Prior to 17.0.2, users with the Manage Users permission can lock and unlock users. This functionality should only be possible for users of the application, but they were not supposed to be able to lock application administrators. Due to a missing permission check this logic was no

CVE-2026-23646 [MEDIUM] CWE-488 CVE-2026-23646: OpenProject is an open-source, web-based project management software. Users of OpenProject versions OpenProject is an open-source, web-based project management software. Users of OpenProject versions prior to 16.6.5 and 17.0.1 have the ability to view and end their active sessions via Account Settings → Sessions. When deleting a session, it was not properly checked if the session belongs to the user. As the ID that is used to identify these session

CVE-2026-55095 [MEDIUM] CWE-862 CVE-2026-55095: OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw custom_field_ project attribute. The dialog path resolves the project custom field by its raw identifier without enforcing the normal admin_only visibility scope and

CVE-2026-44696 [MEDIUM] CWE-79 CVE-2026-44696: OpenProject is open-source, web-based project management software. Prior to 17.4.0, OpenProject's ri OpenProject is open-source, web-based project management software. Prior to 17.4.0, OpenProject's rich text (markdown) rendering pipeline uses Sanitize::Config::RELAXED[:css] for inline style sanitization. This configuration permits essentially all CSS properties in style attributes on permitted HTML elements (figure, img, table, th, tr, td). This al

CVE-2026-52779 [MEDIUM] CWE-639 CVE-2026-52779: OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, a cro OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, a cross-project IDOR / authorization context confusion in the Calendar and Team Planner modules allows a user with management permissions in one project to delete public Calendar or Team Planner Queries from another project where they do not have the corre

CVE-2026-22604 [MEDIUM] CWE-200 CVE-2026-22604: OpenProject is an open-source, web-based project management software. For OpenProject versions from OpenProject is an open-source, web-based project management software. For OpenProject versions from 11.2.1 to before 16.6.2, when sending a POST request to the /account/change_password endpoint with an arbitrary User ID as the password_change_user_id parameter, the resulting error page would show the username for the requested user. Since this endpoi

CVE-2021-32763 [MEDIUM] CWE-400 CVE-2021-32763: OpenProject is open-source, web-based project management software. In versions prior to 11.3.3, the OpenProject is open-source, web-based project management software. In versions prior to 11.3.3, the `MessagesController` class of OpenProject has a `quote` method that implements the logic behind the Quote button in the discussion forums, and it uses a regex to strip `` tags from the message being quoted. The `(.|\s)` part can match a space character

CVE-2024-41801 [MEDIUM] CWE-601 CVE-2024-41801: OpenProject is open source project management software. Prior to version 14.3.0, using a forged HOST OpenProject is open source project management software. Prior to version 14.3.0, using a forged HOST header in the default configuration of packaged installations and using the "Login required" setting, an attacker could redirect to a remote host to initiate a phishing attack against an OpenProject user's account. This vulnerability affects default

CVE-2026-32703 [MEDIUM] CWE-79 CVE-2026-32703: OpenProject is an open-source, web-based project management software. In versions prior to 16.6.9, 1 OpenProject is an open-source, web-based project management software. In versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1, the Repositories module did not properly escape filenames displayed from repositories. This allowed an attacker with push access into the repository to create commits with filenames that included HTML code that was injected i

CVE-2026-27723 [MEDIUM] CWE-284 CVE-2026-27723: OpenProject is an open-source, web-based project management software. Prior to versions 17.0.5 and 1 OpenProject is an open-source, web-based project management software. Prior to versions 17.0.5 and 17.1.2, an attacker can create wiki pages belonging to unpermitted projects through an improperly authenticated request. This issue has been patched in versions 17.0.5 and 17.1.2.