# cve.now: OPF

The newest entries naming OPF as an affected vendor (up to 200), of 55 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-55095](https://cve.now/CVE-2026-55095.md): OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields (CVSS 5.3)
- [CVE-2026-67529](https://cve.now/CVE-2026-67529.md): OpenProject: Private work package subject/identity disclosure through the global Time Entries and Cost Entries APIs (linked work package rendered without visibility check) (CVSS 4.3)
- [CVE-2026-67528](https://cve.now/CVE-2026-67528.md): OpenProject: Improper Access Control through /api/v3/custom\_options/:id via Path "id" leads to Sensitive Data Exposure (CVSS 4.3)
- [CVE-2026-67527](https://cve.now/CVE-2026-67527.md): OpenProject: Improper Access Control through /api/v3/work\_packages/\<X.id\> via PATCH parameter "fileLinks" (CVSS 7.6)
- [CVE-2026-44733](https://cve.now/CVE-2026-44733.md): OpenProject: Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass password requirements (CVSS 5.9)
- [CVE-2026-44731](https://cve.now/CVE-2026-44731.md): OpenProject: Improper Access Control on OpenProject through /projects/\[projectName\]/meetings via "invited\_user\_id" in GET parameter "filters" leads to user names disclosure (CVSS 4.3)
- [CVE-2026-44732](https://cve.now/CVE-2026-44732.md): OpenProject: IDOR on OpenProject through /api/v3/documents/{id} via PATCH parameter "project\_id" leads to Unauthorized Modification of Resources (CVSS 4.3)
- [CVE-2026-44734](https://cve.now/CVE-2026-44734.md): OpenProject: Improper Access Control on OpenProject through the POST request to /projects/\[PROJECT\_NAME\]/cost\_reports/\[REPORT\_ID\]/rename (CVSS 6.5)
- [CVE-2026-44735](https://cve.now/CVE-2026-44735.md): OpenProject: Shares API Information Disclosure (CVSS 6.5)
- [CVE-2026-44696](https://cve.now/CVE-2026-44696.md): OpenProject: Stored CSS injection via Sanitize::Config::RELAXED\[:css\] enables phishing overlays and data exfiltration (CVSS 5.7)
- [CVE-2026-49355](https://cve.now/CVE-2026-49355.md): OpenProject: Private work package data disclosure through single meeting agenda item API (CVSS 4.3)
- [CVE-2026-44736](https://cve.now/CVE-2026-44736.md): OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects (CVSS 6.5)
- [CVE-2026-46386](https://cve.now/CVE-2026-46386.md): OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default \`SECRET\_KEY\_BASE=OVERWRITE\_ME\` and \`cookies\_serializer = :marshal\` (CVSS 9.9)
- [CVE-2026-52780](https://cve.now/CVE-2026-52780.md): OpenProject: Cache store poisoning leads to Remote Code Execution (RCE) (CVSS 9.6)
- [CVE-2026-52779](https://cve.now/CVE-2026-52779.md): OpenProject: Cross-project authorization bypass allows deleting public Calendar and Team Planner queries from unauthorized projects (CVSS 5.4)
- [CVE-2026-47193](https://cve.now/CVE-2026-47193.md): OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks (CVSS 7.5)
- [CVE-2026-52781](https://cve.now/CVE-2026-52781.md): OpenProject: Stored XSS on openproject.example.com through /api/v3/projects/{project}/work\_packages via POST parameter "description" (CVSS 6.4)
- [CVE-2026-52782](https://cve.now/CVE-2026-52782.md): OpenProject: IDOR through /projects/\<A\>/settings/project\_storages/\<A\_ps\_id\> via PATCH parameter "storages\_project\_storage\[project\_folder\_id\]" leads to Access to Unauthorized Resources (CVSS 9.9)
- [CVE-2026-52783](https://cve.now/CVE-2026-52783.md): OpenProject: Information Disclosure (cleartext storage of data) on localhost through memcached via Others "storage.\<id\>.httpx\_access\_token" leads to Sensitive Data Exposure (CVSS 8.2)
- [CVE-2026-52784](https://cve.now/CVE-2026-52784.md): OpenProject: CSRF on TARGET through /users/:id via POST parameter "user\[admin\]" (CVSS 8.8)
- [CVE-2026-52785](https://cve.now/CVE-2026-52785.md): OpenProject: SQL injection in timestamps functionality (CVSS 9.9)
- [CVE-2026-40896](https://cve.now/CVE-2026-40896.md): OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup (CVSS 6.5)
- [CVE-2026-33667](https://cve.now/CVE-2026-33667.md): OpenProject: 2FA OTP Verification Missing Rate Limiting (CVSS 7.4)
- [CVE-2026-34717](https://cve.now/CVE-2026-34717.md): OpenProject: SQL Injection in Cost Reporting =n Operator via parse\_number\_string (CVSS 9.9)
- [CVE-2026-32703](https://cve.now/CVE-2026-32703.md): OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policy (CVSS 9.1)
- [CVE-2026-32698](https://cve.now/CVE-2026-32698.md): OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution (CVSS 9.1)
- [CVE-2026-31974](https://cve.now/CVE-2026-31974.md): Blind SSRF on OpenProject instance via webhooks (CVSS 3.0)
- [CVE-2026-30239](https://cve.now/CVE-2026-30239.md): OpenProject has a Permission Check bypass on Budget deletion allows reassignment of WorkPackages into other budgets (CVSS 6.5)
- [CVE-2026-30236](https://cve.now/CVE-2026-30236.md): OpenProject users that are not project members can be used to calculate Labor Budget, leaking their global hourly rate (CVSS 4.3)
- [CVE-2026-30235](https://cve.now/CVE-2026-30235.md): Business Logic Error on OpenProject through hyperlinks in markdown using DOM clobbering (CVSS 6.5)
- [CVE-2026-30234](https://cve.now/CVE-2026-30234.md): OpenProject BIM BCF XML Import: \<Snapshot\> Path Traversal Leads to Arbitrary Local File Read (AFR) (CVSS 6.5)
- [CVE-2026-27723](https://cve.now/CVE-2026-27723.md): OpenProject: Insufficient access control leads to create Wiki objects belongs unpermitted projects (CVSS 4.3)
- [CVE-2026-24777](https://cve.now/CVE-2026-24777.md): OpenProject has Improper Access Control on User Management allows user managers to lock admin accounts (CVSS 6.7)
- [CVE-2026-25763](https://cve.now/CVE-2026-25763.md): Command Injection on OpenProject repositories leads to Remote Code Execution (CVSS 9.4)
- [CVE-2026-25764](https://cve.now/CVE-2026-25764.md): OpenProject vulnerable to Stored HTML injection (CVSS 3.5)
- [CVE-2026-24776](https://cve.now/CVE-2026-24776.md): OpenProject has an IDOR on MeetingAgendaItems allows cross-project meeting agenda item transfer (CVSS 4.3)
- [CVE-2026-24775](https://cve.now/CVE-2026-24775.md): OpenProject has Forced Actions, Content Spoofing, and Persistent DoS via ID Manipulation in OpenProject Blocknote Editor Extension (CVSS 6.3)
- [CVE-2026-24772](https://cve.now/CVE-2026-24772.md): OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server (CVSS 8.9)
- [CVE-2026-24685](https://cve.now/CVE-2026-24685.md): OpenProject has Argument Injection on Repository module that allows Arbitrary File Write (CVSS 9.4)
- [CVE-2026-23721](https://cve.now/CVE-2026-23721.md): OpenProject users with "View Members" permission in any project can view all Group memberships (CVSS 4.3)
- [CVE-2026-23646](https://cve.now/CVE-2026-23646.md): OpenProject users can delete other user's session, causing them to be logged out (CVSS 6.5)
- [CVE-2026-23625](https://cve.now/CVE-2026-23625.md): OpenProject has stored XSS regression using attachments and script-src self (CVSS 8.7)
- [CVE-2026-22605](https://cve.now/CVE-2026-22605.md): OpenProject is Vulnerable to Insecure Direct Object Reference in Meetings (CVSS 4.3)
- [CVE-2026-22604](https://cve.now/CVE-2026-22604.md): OpenProject is vulnerable to user enumeration via the change password function (CVSS 6.9)
- [CVE-2026-22603](https://cve.now/CVE-2026-22603.md): OpenProject has no protection against brute-force attacks in the Change Password function (CVSS 6.9)
- [CVE-2026-22602](https://cve.now/CVE-2026-22602.md): OpenProject is Vulnerable to User Enumeration via User ID (CVSS 3.5)
- [CVE-2026-22601](https://cve.now/CVE-2026-22601.md): OpenProject is Vulnerable to Code Execution in E-Mail function (CVSS 8.6)
- [CVE-2026-22600](https://cve.now/CVE-2026-22600.md): OpenProject is Vulnerable to Arbitrary File Read via ImageMagick SVG Coder (CVSS 9.1)
- [CVE-2025-24892](https://cve.now/CVE-2025-24892.md): OpenProject stored HTML injection vulnerability (CVSS 3.5)
- [CVE-2024-41801](https://cve.now/CVE-2024-41801.md): OpenProject packaged installation has Open Redirect Vulnerability in Sign-In in default configuration (CVSS 4.7)
- [CVE-2024-35224](https://cve.now/CVE-2024-35224.md): Stored Cross-Site Scripting (XSS) in OpenProject (CVSS 7.6)
- [CVE-2023-33960](https://cve.now/CVE-2023-33960.md): OpenProject vulnerable to project identifier information leakage through robots.txt (CVSS 7.5)
- [CVE-2023-31140](https://cve.now/CVE-2023-31140.md): OpenProject user sessions not terminated after activation of 2FA (CVSS 4.8)
- [CVE-2021-43830](https://cve.now/CVE-2021-43830.md): SQL injection in OpenProject (CVSS 7.4)
- [CVE-2021-32763](https://cve.now/CVE-2021-32763.md): Regular Expression Denial of Service in OpenProject forum messages (CVSS 4.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/opf
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.