Vulnerabilities

TI-2026-39799 CVE-2026-55095

OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields

LOW 24

OpenProject is open-source, web-based project management software.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00396 Published 2026-08-20 Fixed in 17.6.0 CWE-862

TI-2026-47730 CVE-2026-67529

Information disclosure in opf openproject

LOW 20

OpenProject is open-source, web-based project management software.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00411 Published 2026-07-30 Fixed in 17.6.0 CWE-200

TI-2026-47729 CVE-2026-67528

OpenProject: Improper Access Control through /api/v3/custom_options/:id via Path "id" leads to Sensitive Data Exposure

LOW 20

OpenProject is open-source, web-based project management software.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0036 Published 2026-07-30 Fixed in 17.6.0 CWE-863

TI-2026-47728 CVE-2026-67527

OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks"

LOW 34

OpenProject is open-source, web-based project management software.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00432 Published 2026-07-30 Fixed in 17.6.0 CWE-862

TI-2026-32620 CVE-2026-44733

OpenProject: Business Logic Error on OpenProject through PATCH request to…

LOW 26

OpenProject is open-source, web-based project management software.

CVSS 3.1MEDIUM 5.9 Network Low privileges No interaction EPSS 0.0028 Published 2026-06-26 Fixed in 17.3.2 CWE-620

TI-2026-32618 CVE-2026-44731

Authorization bypass in opf openproject

LOW 20

OpenProject is open-source, web-based project management software.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00294 Published 2026-06-26 Fixed in 17.3.2 CWE-639

TI-2026-32619 CVE-2026-44732

Authorization bypass in opf openproject

LOW 20

OpenProject is open-source, web-based project management software.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00276 Published 2026-06-26 Fixed in 17.3.2 CWE-639

TI-2026-32621 CVE-2026-44734

Missing authorization in opf openproject

LOW 29

OpenProject is open-source, web-based project management software.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00326 Published 2026-06-26 Fixed in 17.3.2 CWE-862

TI-2026-32622 CVE-2026-44735

OpenProject: Shares API Information Disclosure

LOW 29

OpenProject is open-source, web-based project management software.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0037 Published 2026-06-26 Fixed in 17.3.2 CWE-863

TI-2026-32587 CVE-2026-44696

OpenProject: Stored CSS injection via Sanitize::Config::RELAXED[:css] enables phishing overlays and data exfiltration

MEDIUM 59

OpenProject is open-source, web-based project management software.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00253 Published 2026-06-26 Fixed in 17.4.0 CWE-79

TI-2026-36528 CVE-2026-49355

OpenProject: Private work package data disclosure through single meeting agenda item API

LOW 20

OpenProject is open-source, web-based project management software.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00294 Published 2026-06-26 Fixed in 17.4.0 CWE-200

TI-2026-32623 CVE-2026-44736

OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects

MEDIUM 62

OpenProject is open-source, web-based project management software.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00356 Published 2026-06-26 Fixed in 17.4.0 CWE-200

TI-2026-34100 CVE-2026-46386

Deserialization of untrusted data in opf openproject

MEDIUM 43

OpenProject is open-source, web-based project management software.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.0049 Published 2026-06-26 Fixed in 17.2.4, 17.3.2 CWE-1188

TI-2026-37895 CVE-2026-52780

OpenProject: Cache store poisoning leads to Remote Code Execution (RCE)

MEDIUM 43

OpenProject is open-source, web-based project management software.

CVSS 3.1CRITICAL 9.6 Adjacent network No auth No interaction EPSS 0.0039 Published 2026-06-26 Fixed in 17.3.3, 17.4.1 CWE-20

TI-2026-37894 CVE-2026-52779

Authorization bypass in opf openproject

MEDIUM 58

OpenProject is open-source, web-based project management software.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00222 Published 2026-06-26 Fixed in 17.3.3, 17.4.1 CWE-639

TI-2026-34781 CVE-2026-47193

OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks

HIGH 72

OpenProject is open-source, web-based project management software.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00314 Published 2026-06-26 Fixed in 17.3.3, 17.4.1 CWE-200

TI-2026-37896 CVE-2026-52781

Cross-site scripting in opf openproject

LOW 28

OpenProject is open-source, web-based project management software.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00251 Published 2026-06-26 Fixed in 17.3.3, 17.4.1 CWE-79

TI-2026-37897 CVE-2026-52782

Authorization bypass in opf openproject

MEDIUM 43

OpenProject is open-source, web-based project management software.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00454 Published 2026-06-26 Fixed in 17.3.3, 17.4.1 CWE-639

TI-2026-37898 CVE-2026-52783

OpenProject: Information Disclosure (cleartext storage of data) on localhost through…

LOW 37

OpenProject is open-source, web-based project management software.

CVSS 3.1HIGH 8.2 Network Low privileges No interaction EPSS 0.00199 Published 2026-06-26 Fixed in 17.3.3, 17.4.1 CWE-313

TI-2026-37899 CVE-2026-52784

OpenProject: CSRF on TARGET through /users/:id via POST parameter "user[admin]"

MEDIUM 40

OpenProject is open-source, web-based project management software.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00241 Published 2026-06-26 Fixed in 17.3.3, 17.4.1 CWE-352

TI-2026-37900 CVE-2026-52785

OpenProject: SQL injection in timestamps functionality

MEDIUM 43

OpenProject is open-source, web-based project management software.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00377 Published 2026-06-26 Fixed in 17.3.3, 17.4.1 CWE-89

TI-2026-29552 CVE-2026-40896

OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup

MEDIUM 64

OpenProject is open-source, web-based project management software.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00174 Published 2026-04-20 Fixed in 17.3.0 CWE-367

TI-2026-26047 CVE-2026-33667

OpenProject: 2FA OTP Verification Missing Rate Limiting

HIGH 68

OpenProject is an open-source project management application.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00296 Published 2026-04-15 Fixed in 17.3.0 CWE-307

TI-2026-26961 CVE-2026-34717

OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string

MEDIUM 43

OpenProject is an open-source, web-based project management software.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00274 Published 2026-04-02 Fixed in 17.2.3 CWE-89

TI-2026-25195 CVE-2026-32703

OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policy

MEDIUM 41

OpenProject is an open-source, web-based project management software.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.00196 Published 2026-03-18 Fixed in 16.6.9, 17.0.6 +2 CWE-79

Vulnerabilities

Filters