EUVD-2026-39882Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Requires authenticated low-privilege session (PR:L); network-accessible with no complexity barriers; integrity-only impact as documents can be moved cross-project but data cannot be read or destroyed.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, OpenProject exposes a document update endpoint used to modify existing documents. The target document is loaded with visibility checks and then updated. During update, attacker-controlled attributes are applied to the persisted record before authorization is enforced. As a result, a user without :manage_documents in the source project can move and modify foreign project documents by setting project_id in a single PATCH request. This vulnerability is fixed in 17.3.2 and 17.4.0.
AnalysisAI
OpenProject's document update endpoint before versions 17.3.2 and 17.4.0 contains an authorization order-of-operations flaw (CWE-639) that allows any authenticated low-privilege user to move or modify documents belonging to projects they do not have permission to manage. By sending a single crafted PATCH request containing a project_id attribute pointing to a foreign project, the attacker exploits the endpoint's incorrect sequence - attributes are applied to the record before authorization is enforced - bypassing the :manage_documents permission check entirely. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV; however, the attack requires only a valid user session and standard HTTP tooling.
Technical ContextAI
OpenProject is an open-source, Ruby on Rails-based web project management platform (CPE: cpe:2.3:a:opf:openproject). The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the document update endpoint follows an unsafe sequence of load → apply attacker-supplied attributes → authorize, rather than the secure order of load → authorize → apply attributes. This means the authorization gate evaluates permissions against the original document state while the database record has already been mutated with the user-supplied project_id. A user who has visibility into at least one project can therefore pivot that document into any other project they can enumerate, regardless of their permission level in the destination project. The flaw is specific to the document update PATCH endpoint and is not a general Rails mass-assignment issue but rather a bespoke authorization sequencing defect.
RemediationAI
Upgrade to OpenProject 17.3.2 or 17.4.0, both of which correct the authorization sequence so that permission checks are enforced before attacker-controlled attributes are applied to the document record. The vendor advisory with upgrade guidance is at https://github.com/opf/openproject/security/advisories/GHSA-mqvv-5mvc-7pg7. If an immediate upgrade is not feasible, consider restricting access to the document update API endpoint at the WAF or reverse-proxy layer to trusted internal network ranges, reducing exposure to external or untrusted authenticated users. Alternatively, temporarily disabling document management functionality for untrusted user roles reduces risk but disrupts legitimate workflows. Neither workaround addresses the underlying flaw and both impose operational trade-offs; patching to 17.3.2 or 17.4.0 is the only complete remediation.
More in Openproject
View allA SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbi
OpenProject is web-based project management software. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
OpenProject is open source project management software. Rated medium severity (CVSS 6.5), this vulnerability is remotely
Authenticated remote code execution affects the official openproject/openproject Docker image, which ships with a hardco
Cross-project folder hijacking in OpenProject before 17.3.3 and 17.4.1 lets a project-admin abuse an insecure direct obj
SQL injection in OpenProject's baseline-comparison (timestamps) functionality lets an authenticated, low-privileged user
OpenProject has a CVSS 9.9 command injection vulnerability allowing authenticated users to execute OS commands on the pr
Remote code execution in OpenProject before 17.3.3 and 17.4.1 arises from cache store poisoning, allowing an attacker wi
OpenProject, a web-based project management platform, contains a critical SQL injection vulnerability in versions prior
OpenProject (before 16.6.4) has a local file read vulnerability through SVG-based ImageMagick exploitation in the PDF ex
OpenProject's Repositories module contains a stored cross-site scripting (XSS) vulnerability that occurs when displaying
Token decryption in OpenProject 17.0 allows authenticated attackers to intercept and decrypt 24-hour authentication toke
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today