CVE-2026-40896 Details
Description
OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with `manage_agendas` permission in any project can inject agenda items into meetings belonging to any other project on the instance — even projects they have no access to. No knowledge of the target project, meeting, or victim is required; the attacker can blindly spray items into every meeting on the instance by iterating sequential section IDs. Version 17.3.0 patches the issue.
A vulnerability exists in OpenProject versions prior to 17.3.0, allowing users with 'manage_agendas' permission to inject agenda items into meetings of any project on the instance, regardless of access rights. This is achieved by exploiting a lack of proper authorization checks, enabling blind injection of items into meetings by iterating through section IDs. The issue has been patched in version 17.3.0.
Users can update to OpenProject version 17.3.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/opf/openproject/security/advisories/GHSA-hh5p-gwf8-h245 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/opf/openproject/commit/8f693a1f35d0a84bb69af78fb6925f74329ae4fe | [email protected] | Patch |
| https://github.com/opf/openproject/security/advisories/GHSA-hh5p-gwf8-h245 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openproject openproject | < 17.3.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 23, 2026 | Initial Analysis | [email protected] |
| Apr 20, 2026 | CVE Modified | CISA-ADP |
| Apr 20, 2026 | New CVE Received | [email protected] |