OPF vulnerabilities
55 CVEs and advisories name OPF as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-55095OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields
- CVE-2026-67529OpenProject: Private work package subject/identity disclosure through the global Time Entries and Cost Entries APIs (linked work package rendered without visibility check)
- CVE-2026-67528OpenProject: Improper Access Control through /api/v3/custom_options/:id via Path "id" leads to Sensitive Data Exposure
- CVE-2026-67527OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks"
- CVE-2026-44733OpenProject: Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass password requirements
- CVE-2026-44731OpenProject: Improper Access Control on OpenProject through /projects/[projectName]/meetings via "invited_user_id" in GET parameter "filters" leads to user names disclosure
- CVE-2026-44732OpenProject: IDOR on OpenProject through /api/v3/documents/{id} via PATCH parameter "project_id" leads to Unauthorized Modification of Resources
- CVE-2026-44734OpenProject: Improper Access Control on OpenProject through the POST request to /projects/[PROJECT_NAME]/cost_reports/[REPORT_ID]/rename
- CVE-2026-44735OpenProject: Shares API Information Disclosure
- CVE-2026-44696OpenProject: Stored CSS injection via Sanitize::Config::RELAXED[:css] enables phishing overlays and data exfiltration
- CVE-2026-49355OpenProject: Private work package data disclosure through single meeting agenda item API
- CVE-2026-44736OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects
- CVE-2026-46386OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`
- CVE-2026-52780OpenProject: Cache store poisoning leads to Remote Code Execution (RCE)
- CVE-2026-52779OpenProject: Cross-project authorization bypass allows deleting public Calendar and Team Planner queries from unauthorized projects
- CVE-2026-47193OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks
- CVE-2026-52781OpenProject: Stored XSS on openproject.example.com through /api/v3/projects/{project}/work_packages via POST parameter "description"
- CVE-2026-52782OpenProject: IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[project_folder_id]" leads to Access to Unauthorized Resources
- CVE-2026-52783OpenProject: Information Disclosure (cleartext storage of data) on localhost through memcached via Others "storage.<id>.httpx_access_token" leads to Sensitive Data Exposure
- CVE-2026-52784OpenProject: CSRF on TARGET through /users/:id via POST parameter "user[admin]"
- CVE-2026-52785OpenProject: SQL injection in timestamps functionality
- CVE-2026-40896OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup
- CVE-2026-33667OpenProject: 2FA OTP Verification Missing Rate Limiting
- CVE-2026-34717OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string
- CVE-2026-32703OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policy
- CVE-2026-32698OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution
- CVE-2026-31974Blind SSRF on OpenProject instance via webhooks
- CVE-2026-30239OpenProject has a Permission Check bypass on Budget deletion allows reassignment of WorkPackages into other budgets
- CVE-2026-30236OpenProject users that are not project members can be used to calculate Labor Budget, leaking their global hourly rate
- CVE-2026-30235Business Logic Error on OpenProject through hyperlinks in markdown using DOM clobbering