PT-2026-33783 · Unknown · Openproject

Published 2026-04-20 · Updated 2026-04-21 · CVE-2026-40896

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.3.0

Description A user with manage agendas permission in any project can inject agenda items into meetings belonging to any other project on the instance, including those they cannot access. This is possible by iterating sequential section IDs, allowing an attacker to blindly spray items into every meeting on the instance without needing prior knowledge of the target project, meeting, or victim.

Recommendations Update to version 17.3.0.

Exploit

Fix

Time Of Check To Time Of Use

IDOR

Weakness Enumeration

CWE-367

CWE-639

Related Identifiers

CVE-2026-40896

Affected Products

Openproject

References · 5

• 🔥 https://github.com/opf/openproject/security/advisories/GHSA-hh5p-gwf8-h245 · Exploit
• https://github.com/opf/openproject/commit/8f693a1f35d0a84bb69af78fb6925f74329ae4fe · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40896 · Security Note
• https://twitter.com/CVEnew/status/2046601504577016296 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2046285081673625722 · Twitter Post