OpenProject CVE-2026-44696

Exploitation requires an authenticated OpenProject account with write access to at least one formattable text field - specifically work package descriptions, work package comments, project descriptions, or news items. The attacker must be able to save rich text content to a resource that a target user will subsequently view (UI:R). No administrative or elevated role is required beyond standard contributor/member write permissions. Exploitation is limited by: (1) mandatory authentication - unauthenticated attackers cannot exploit this; (2) the victim must navigate to and render the page containing the malicious content; (3) the CSS injection is scoped to the rendered page context (S:U, no scope change to other origins). Instances where all project members are fully trusted employees represent minimal risk; externally accessible instances or those with untrusted contractor accounts face higher realistic risk.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N) scores 5.7 (Medium), reflecting a network-exploitable flaw requiring low privileges and victim interaction. PR:L confirms that write access to formattable fields is a hard prerequisite, limiting exposure relative to unauthenticated XSS. UI:R means a victim must actively view the injected content, further constraining impact. The I:H rating aligns with real-world CSS injection capabilities: full-page UI manipulation, phishing overlays, and clickjacking are achievable. C:N may slightly understate risk since CSS attribute-selector timing attacks and background-image exfiltration can leak limited data, though this is not explicitly confirmed in the advisory. No EPSS data was provided; without KEV listing or known POC, exploitation at scale is unlikely but opportunistic insider abuse (authenticated project members) is a realistic threat vector. This is a genuine medium-priority issue for multi-tenant or externally accessible OpenProject instances rather than a theoretical risk.

An authenticated OpenProject user with write access to a shared project crafts a work package description containing an img or table element with a style attribute using position:fixed, top:0, left:0, width:100vw, height:100vh to overlay a fake login prompt over the entire viewport. When a colleague or project manager opens the work package, the CSS renders in their browser, presenting a phishing interface that mimics the OpenProject login page to harvest credentials. No public exploit code has been identified at time of analysis, but the technique requires only basic CSS knowledge.