Opf Openproject vulnerabilities

CVE-2026-44735 [MEDIUM] CWE-863 CVE-2026-44735: OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the G OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the GET /api/v3/shares endpoint returns share details for ALL work packages in a project to any user with the view_shared_work_packages permission. The authorization check operates at the project level only — it does not verify the requesting user can actu

CVE-2026-44734 [MEDIUM] CWE-862 CVE-2026-44734: OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, a Mis OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, a Missing Authorization vulnerability exists in OpenProject's CostReportsController. The rename and update actions allow any authenticated user to modify the name, filters, and grouping of any Public cost report in the system without verifying ownership or

CVE-2026-40896 [HIGH] CWE-367 CVE-2026-40896: OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user w OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with `manage_agendas` permission in any project can inject agenda items into meetings belonging to any other project on the instance — even projects they have no access to. No knowledge of the target project, meeting, or victim is required; the attacker

CVE-2026-30234 [MEDIUM] CWE-22 CVE-2026-30234: OpenProject is an open-source, web-based project management software. Prior to 17.2.0, an authentica OpenProject is an open-source, web-based project management software. Prior to 17.2.0, an authenticated project member with BCF import permissions can upload a crafted .bcf archive where the value in markup.bcf is manipulated to contain an absolute or traversal local path (for example: /etc/passwd or ../../../../etc/passwd). During import, this untru

CVE-2026-52781 [MEDIUM] CWE-79 CVE-2026-52781: OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the H OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the HTML sanitizer grants elements unrestricted data-* attributes via :data wildcard. An attacker injects data-controller="poll-for-changes" into a work package description, causing Stimulus.js to mount a controller that fetches an attacker-uploaded attachm

CVE-2026-30239 [HIGH] CWE-863 CVE-2026-30239: OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when budgets OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when budgets are deleted, the work packages that were assigned to this budget need to be moved to a different budget. This action was performed before the permission check on the delete action was executed. This allowed all users in the application to delete work pac

CVE-2023-31140 [MEDIUM] CWE-613 CVE-2023-31140: OpenProject is open source project management software. Starting with version 7.4.0 and prior to ver OpenProject is open source project management software. Starting with version 7.4.0 and prior to version 12.5.4, when a user registers and confirms their first two-factor authentication (2FA) device for an account, existing logged in sessions for that user account are not terminated. Likewise, if an administrators creates a mobile phone 2FA device o

CVE-2026-44733 [MEDIUM] CWE-620 CVE-2026-44733: OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, Busin OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass password requirements. A password validation flaw in the change password behavior allows attackers to change a user's password only with an active session takeo

CVE-2026-24777 [MEDIUM] CWE-862 CVE-2026-24777: OpenProject is an open-source, web-based project management software. Prior to 17.0.2, users with th OpenProject is an open-source, web-based project management software. Prior to 17.0.2, users with the Manage Users permission can lock and unlock users. This functionality should only be possible for users of the application, but they were not supposed to be able to lock application administrators. Due to a missing permission check this logic was no

CVE-2026-23646 [MEDIUM] CWE-488 CVE-2026-23646: OpenProject is an open-source, web-based project management software. Users of OpenProject versions OpenProject is an open-source, web-based project management software. Users of OpenProject versions prior to 16.6.5 and 17.0.1 have the ability to view and end their active sessions via Account Settings → Sessions. When deleting a session, it was not properly checked if the session belongs to the user. As the ID that is used to identify these session

CVE-2026-30235 [MEDIUM] CWE-79 CVE-2026-30235: OpenProject is an open-source, web-based project management software. Prior to 17.2.0, this vulnerab OpenProject is an open-source, web-based project management software. Prior to 17.2.0, this vulnerability occurs due to improper validation of OpenProject’s Markdown rendering, specifically in the hyperlink handling. This allows an attacker to inject malicious hyperlink payloads that perform DOM clobbering. DOM clobbering can crash or blank the entir

CVE-2021-32763 [MEDIUM] CWE-400 CVE-2021-32763: OpenProject is open-source, web-based project management software. In versions prior to 11.3.3, the OpenProject is open-source, web-based project management software. In versions prior to 11.3.3, the `MessagesController` class of OpenProject has a `quote` method that implements the logic behind the Quote button in the discussion forums, and it uses a regex to strip `` tags from the message being quoted. The `(.|\s)` part can match a space character

CVE-2026-44696 [MEDIUM] CWE-79 CVE-2026-44696: OpenProject is open-source, web-based project management software. Prior to 17.4.0, OpenProject's ri OpenProject is open-source, web-based project management software. Prior to 17.4.0, OpenProject's rich text (markdown) rendering pipeline uses Sanitize::Config::RELAXED[:css] for inline style sanitization. This configuration permits essentially all CSS properties in style attributes on permitted HTML elements (figure, img, table, th, tr, td). This al

CVE-2026-52779 [MEDIUM] CWE-639 CVE-2026-52779: OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, a cro OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, a cross-project IDOR / authorization context confusion in the Calendar and Team Planner modules allows a user with management permissions in one project to delete public Calendar or Team Planner Queries from another project where they do not have the corre

CVE-2026-22604 [MEDIUM] CWE-200 CVE-2026-22604: OpenProject is an open-source, web-based project management software. For OpenProject versions from OpenProject is an open-source, web-based project management software. For OpenProject versions from 11.2.1 to before 16.6.2, when sending a POST request to the /account/change_password endpoint with an arbitrary User ID as the password_change_user_id parameter, the resulting error page would show the username for the requested user. Since this endpoi

CVE-2024-41801 [MEDIUM] CWE-601 CVE-2024-41801: OpenProject is open source project management software. Prior to version 14.3.0, using a forged HOST OpenProject is open source project management software. Prior to version 14.3.0, using a forged HOST header in the default configuration of packaged installations and using the "Login required" setting, an attacker could redirect to a remote host to initiate a phishing attack against an OpenProject user's account. This vulnerability affects default

CVE-2026-27723 [MEDIUM] CWE-284 CVE-2026-27723: OpenProject is an open-source, web-based project management software. Prior to versions 17.0.5 and 1 OpenProject is an open-source, web-based project management software. Prior to versions 17.0.5 and 17.1.2, an attacker can create wiki pages belonging to unpermitted projects through an improperly authenticated request. This issue has been patched in versions 17.0.5 and 17.1.2.

CVE-2026-32703 [MEDIUM] CWE-79 CVE-2026-32703: OpenProject is an open-source, web-based project management software. In versions prior to 16.6.9, 1 OpenProject is an open-source, web-based project management software. In versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1, the Repositories module did not properly escape filenames displayed from repositories. This allowed an attacker with push access into the repository to create commits with filenames that included HTML code that was injected i

CVE-2025-24892 [MEDIUM] CWE-79 CVE-2025-24892: OpenProject is open-source, web-based project management software. In versions prior to 15.2.1, the OpenProject is open-source, web-based project management software. In versions prior to 15.2.1, the application fails to properly sanitize user input before displaying it in the Group Management section. Groups created with HTML script tags are not properly escaped before rendering them in a project. The issue has been resolved in OpenProject version

CVE-2024-35224 [MEDIUM] CWE-80 CVE-2024-35224: OpenProject is the leading open source project management software. OpenProject utilizes `tablesorte OpenProject is the leading open source project management software. OpenProject utilizes `tablesorter` inside of the Cost Report feature. This dependency, when misconfigured, can lead to Stored XSS via `{icon}` substitution in table header values. This attack requires the permissions "Edit work packages" as well as "Add attachments". A project admin