PT-2026-33783 · Opf · Openproject

Published 2026-04-20 · Updated 2026-04-20 · CVE-2026-40896

NVD

CVSS v3.1

6.5

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with manage agendas permission in any project can inject agenda items into meetings belonging to any other project on the instance — even projects they have no access to. No knowledge of the target project, meeting, or victim is required; the attacker can blindly spray items into every meeting on the instance by iterating sequential section IDs. Version 17.3.0 patches the issue.

Fix

Time Of Check To Time Of Use

IDOR

Weakness Enumeration

CWE-367

CWE-639

Related Identifiers

CVE-2026-40896

Affected Products

Openproject

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-40896 · Security Note
• https://github.com/opf/openproject/security/advisories/GHSA-hh5p-gwf8-h245 · Note
• https://github.com/opf/openproject/commit/8f693a1f35d0a84bb69af78fb6925f74329ae4fe · Note