CVE-2026-52779
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In OpenProject prior to versions 17.3.3 and 17.4.1, an IDOR vulnerability in the Calendar and Team Planner modules allows a user with management permissions in one project to delete public queries from another project where they lack such permissions.
Risk Assessment
An attacker can use permissions from Project A to delete shared Calendar or Team Planner views from Project B, causing integrity impact and limited availability impact for users relying on those shared views.
Recommendation
Immediately upgrade OpenProject to version 17.3.3 or 17.4.1, which contain the fix for this vulnerability.
Other vulnerabilities in OpenProject
See all- CVE-2026-22601High
OpenProject is an open-source, web-based project management software. In version 16.6.1 and below, a registered administrator can execute arbitrary commands by configuring the sendmail binary path and sending a test email. This issue has been patched in version 16.6.2.
- CVE-2017-11667High
OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, allowing remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session.
- CVE-2026-52785Critical
OpenProject before versions 17.3.3 and 17.4.1 contains a SQL injection vulnerability in the timestamps functionality. Attackers can exploit the timestamps parameter to execute unauthorized database queries.
- CVE-2026-52782Critical
In OpenProject prior to versions 17.3.3 and 17.4.1, an IDOR vulnerability exists in the endpoint /projects/<A>/settings/project_storages/<A_ps_id> via the PATCH parameter "storages_project_storage[project_folder_id]". A project administrator can hijack the managed Nextcloud or OneDrive folder of another project on the same storage, leading to unauthorized resource access.
- CVE-2026-46386Critical
The official openproject/openproject Docker image ships with a default SECRET_KEY_BASE=OVERWRITE_ME, which combined with cookies_serializer = :marshal allows any logged-in user a deterministic Marshal-deserialization path via the /my/two_factor_devices cookie reader. This vulnerability is fixed in a later version.
- CVE-2026-34717Critical
OpenProject prior to version 17.2.3 has an SQL injection vulnerability in the =n operator in modules/reporting/lib/report/operator.rb:177. This operator embeds user input directly into SQL WHERE clauses without parameterization.
- CVE-2026-22600Critical
OpenProject before version 16.6.4 contains a Local File Read vulnerability in the work package PDF export. By uploading a specially crafted SVG file (disguised as PNG) as an attachment, an attacker can exploit the ImageMagick engine to read arbitrary local files accessible to the application user.
- CVE-2026-55095Medium
OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw custom_field_ project attribute. The dialog path resolves the project custom field by its raw identifier without enforcing the normal admin_only visibility scope and renders the stored custom-field comment in read-only mode. This discloses hidden comment text but does not disclose the custom-field value or permit writes or mutation. This issue is reported as fixed in version 17.6.0.
- CVE-2026-67529Medium
OpenProject before 17.6.0 in GET /api/v3/time_entries and GET /api/v3/cost_entries exposed private work package titles and IDs without visibility checks. Users with view_time_entries or view_cost_entries could read this data.
- CVE-2026-67528Medium
OpenProject before 17.6.0 in GET /api/v3/custom_options/:id resolved custom options by global numeric ID without visibility checks. Authenticated non-admin users could enumerate IDs and read labels of admin-only options.
Original NVD description (English source)
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, a cross-project IDOR / authorization context confusion in the Calendar and Team Planner modules allows a user with management permissions in one project to delete public Calendar or Team Planner Queries from another project where they do not have the corresponding management permissions. Both modules authorize the request against the project identified by :project_id in the URL, but the actual Query object is loaded later by :id from Query.visible(current_user) without verifying that the loaded Query belongs to the authorized project. As a result, an attacker can use permissions from Project A to delete shared/public Calendar or Team Planner views from Project B, causing integrity impact and limited availability impact for users relying on those shared views. This vulnerability is fixed in 17.3.3 and 17.4.1.