PT-2026-5180 · Openproject · Openproject+1

Scott Curtis + 1 · Published 2026-01-28 · Updated 2026-02-12 · CVE-2026-24775

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenProject versions 17.0.0 through 17.0.1

Description OpenProject is a web-based project management software. A flaw exists in the BlockNote editor extension introduced in version 17.0.0, which allows mentioning OpenProject work packages within collaborative documents. The extension does not properly validate the work package ID used in API calls to retrieve work package details. This allows an attacker to create documents containing relative links that, when opened, can trigger arbitrary GET requests to any URL within the OpenProject instance. The API call is used to load work package details. The issue was addressed in version 0.0.22 of the op-blocknote-extensions component, included in OpenProject 17.0.2.

Recommendations Update to OpenProject version 17.0.2. If an immediate update is not possible, disable collaborative document editing in Settings -> Documents -> Real time collaboration -> Disable.

Exploit

Fix

DoS

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2026-24775

GHSA-35C6-X276-2PVC

Affected Products

Openproject

Op-Blocknote-Extensions

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24775.json · Exploit
• https://github.com/opf/openproject/security/advisories/GHSA-35c6-x276-2pvc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24775 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24775 · Security Note
• https://github.com/opf/op-blocknote-extensions/releases/tag/v0.0.22 · Note
• https://t.me/cveNotify/151884 · Telegram Post
• https://t.me/CVEtracker/43165 · Telegram Post