OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with `manage_agendas` permission in any project can inject agenda items into meetings belonging to any other project on the instance — even projects they have no access to. No knowledge of the target project, meeting, or victim is required; the attacker can blindly spray items into every meeting on the instance by iterating sequential section IDs. Version 17.3.0 patches the issue.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/opf/openproject/commit/8f693a1f35d0a84bb69af78fb6925f74329ae4fe Patch
- https://github.com/opf/openproject/security/advisories/GHSA-hh5p-gwf8-h245 Exploit, Mitigation, Vendor Advisory
- https://github.com/opf/openproject/security/advisories/GHSA-hh5p-gwf8-h245 Exploit, Mitigation, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.1 · openprojectNVD modified 2026-10-26 21:10
Affected (CPE criteria) 1
cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*
References 3
- https://github.com/opf/openproject/commit/8f693a1f35d0a84bb69af78fb6925f74329ae4fe Patch
- https://github.com/opf/openproject/security/advisories/GHSA-hh5p-gwf8-h245 Exploit, Mitigation, Vendor Advisory
- https://github.com/opf/openproject/security/advisories/GHSA-hh5p-gwf8-h245 Exploit, Mitigation, Vendor Advisory