CVE-2023-33960
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
OpenProject is web-based project management software. In versions prior to 12.5.6, the `robots.txt` file was publicly accessible, revealing identifiers of all public projects even when the entire instance required login.
Risk Assessment
The exposure of project identifiers may lead to unauthorized access to project information, posing a risk to the organization's data security.
Recommendation
It is recommended to upgrade to version 12.5.6 or apply a patch for OpenProject versions greater than 10.0. Alternatively, public projects can be marked as non-public to restrict access.
Other vulnerabilities in OpenProject
See all- CVE-2026-22601High
OpenProject is an open-source, web-based project management software. In version 16.6.1 and below, a registered administrator can execute arbitrary commands by configuring the sendmail binary path and sending a test email. This issue has been patched in version 16.6.2.
- CVE-2017-11667High
OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, allowing remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session.
- CVE-2026-52785Critical
OpenProject before versions 17.3.3 and 17.4.1 contains a SQL injection vulnerability in the timestamps functionality. Attackers can exploit the timestamps parameter to execute unauthorized database queries.
- CVE-2026-52782Critical
In OpenProject prior to versions 17.3.3 and 17.4.1, an IDOR vulnerability exists in the endpoint /projects/<A>/settings/project_storages/<A_ps_id> via the PATCH parameter "storages_project_storage[project_folder_id]". A project administrator can hijack the managed Nextcloud or OneDrive folder of another project on the same storage, leading to unauthorized resource access.
- CVE-2026-46386Critical
The official openproject/openproject Docker image ships with a default SECRET_KEY_BASE=OVERWRITE_ME, which combined with cookies_serializer = :marshal allows any logged-in user a deterministic Marshal-deserialization path via the /my/two_factor_devices cookie reader. This vulnerability is fixed in a later version.
- CVE-2026-34717Critical
OpenProject prior to version 17.2.3 has an SQL injection vulnerability in the =n operator in modules/reporting/lib/report/operator.rb:177. This operator embeds user input directly into SQL WHERE clauses without parameterization.
- CVE-2026-22600Critical
OpenProject before version 16.6.4 contains a Local File Read vulnerability in the work package PDF export. By uploading a specially crafted SVG file (disguised as PNG) as an attachment, an attacker can exploit the ImageMagick engine to read arbitrary local files accessible to the application user.
- CVE-2026-55095Medium
OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw custom_field_ project attribute. The dialog path resolves the project custom field by its raw identifier without enforcing the normal admin_only visibility scope and renders the stored custom-field comment in read-only mode. This discloses hidden comment text but does not disclose the custom-field value or permit writes or mutation. This issue is reported as fixed in version 17.6.0.
- CVE-2026-67529Medium
OpenProject before 17.6.0 in GET /api/v3/time_entries and GET /api/v3/cost_entries exposed private work package titles and IDs without visibility checks. Users with view_time_entries or view_cost_entries could read this data.
- CVE-2026-67528Medium
OpenProject before 17.6.0 in GET /api/v3/custom_options/:id resolved custom options by global numeric ID without visibility checks. Authenticated non-admin users could enumerate IDs and read labels of admin-only options.
Original NVD description (English source)
OpenProject is web-based project management software. For any OpenProject installation, a `robots.txt` file is generated through the server to denote which routes shall or shall not be accessed by crawlers. These routes contain project identifiers of all public projects in the instance. Prior to version 12.5.6, even if the entire instance is marked as `Login required` and prevents all truly anonymous access, the `/robots.txt` route remains publicly available. Version 12.5.6 has a fix for this issue. Alternatively, users can download a patchfile to apply the patch to any OpenProject version greater than 10.0 As a workaround, one may mark any public project as non-public and give anyone in need of access to the project a membership.