CVE-2026-40896

OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with `manage_agendas` permission in any project can inject agenda items into meetings belonging to any other project on the instance — even projects they have no access to. No knowledge of the target project, meeting, or victim is required; the attacker can blindly spray items into every meeting on the instance by iterating sequential section IDs. Version 17.3.0 patches the issue.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/opf/openproject/commit/8f693a1f35d0a84bb69af78fb6925f74329ae4fe	Patch
https://github.com/opf/openproject/security/advisories/GHSA-hh5p-gwf8-h245	Exploit Mitigation Vendor Advisory
https://github.com/opf/openproject/security/advisories/GHSA-hh5p-gwf8-h245	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) OpenProject es un software de gestión de proyectos de código abierto y basado en la web. Antes de la versión 17.3.0, un usuario con permiso ’manage_agendas’ en cualquier proyecto puede inyectar elementos de la agenda en reuniones pertenecientes a cualquier otro proyecto en la instancia, incluso proyectos a los que no tiene acceso. No se requiere conocimiento del proyecto objetivo, la reunión o la víctima; el atacante puede inyectar elementos de forma indiscriminada en cada reunión de la instancia al iterar IDs de sección secuenciales. La versión 17.3.0 corrige el problema.

Information

Published : 2026-04-20 16:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-40896

Mitre link : CVE-2026-40896

CVE.ORG link : CVE-2026-40896

JSON object : View

Products Affected

openproject

openproject

CWE

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-40896", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40896", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T16:13:05.532704Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "opf", "product": "openproject", "versions": [{"status": "affected", "version": "< 17.3.0"}]}]}], "published": "2026-04-20T16:16:48.567", "references": [{"url": "https://github.com/opf/openproject/commit/8f693a1f35d0a84bb69af78fb6925f74329ae4fe", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/opf/openproject/security/advisories/GHSA-hh5p-gwf8-h245", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/opf/openproject/security/advisories/GHSA-hh5p-gwf8-h245", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-367"}, {"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with `manage_agendas` permission in any project can inject agenda items into meetings belonging to any other project on the instance \u2014 even projects they have no access to. No knowledge of the target project, meeting, or victim is required; the attacker can blindly spray items into every meeting on the instance by iterating sequential section IDs. Version 17.3.0 patches the issue."}, {"lang": "es", "value": "OpenProject es un software de gesti\u00f3n de proyectos de c\u00f3digo abierto y basado en la web. Antes de la versi\u00f3n 17.3.0, un usuario con permiso \u2019manage_agendas\u2019 en cualquier proyecto puede inyectar elementos de la agenda en reuniones pertenecientes a cualquier otro proyecto en la instancia, incluso proyectos a los que no tiene acceso. No se requiere conocimiento del proyecto objetivo, la reuni\u00f3n o la v\u00edctima; el atacante puede inyectar elementos de forma indiscriminada en cada reuni\u00f3n de la instancia al iterar IDs de secci\u00f3n secuenciales. La versi\u00f3n 17.3.0 corrige el problema."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C9F05E3-C32E-4932-BFBB-8F3E2D9D4292", "versionEndExcluding": "17.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}