CVE-2026-40896

Summary

OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with manage_agendas permission in any project can inject agenda items into meetings belonging to any other project on the instance — even projects they have no access to. No knowledge of the target project, meeting, or victim is required; the attacker can blindly spray items into every meeting on the instance by iterating sequential section IDs. Version 17.3.0 patches the issue.

Affected Software

VendorProductVersion RangeStatus
opfopenproject< 17.3.0affected

Weaknesses

  • CWE-367: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
  • CWE-639: CWE-639: Authorization Bypass Through User-Controlled Key

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

Additional References

References