What is the CVSS score of CVE-2026-44734?

CVE-2026-44734 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-44734?

Yes, a patch is available for CVE-2026-44734. Update the affected software to the latest version immediately.

OpenProject CVE-2026-44734

EUVD-2026-39881 MEDIUM

Missing Authorization (CWE-862)

2026-06-26 GitHub_M

Authentication Bypass Openproject Opf

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable controller action, low complexity, authenticated low-privilege user can overwrite any public report; no confidentiality or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 26, 2026 - 21:02 EUVD

Analysis Generated

Jun 26, 2026 - 20:32 vuln.today

DescriptionCVE.org

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, a Missing Authorization vulnerability exists in OpenProject's CostReportsController. The rename and update actions allow any authenticated user to modify the name, filters, and grouping of any Public cost report in the system without verifying ownership or permission level. An attacker who discovers or guesses a public report's numeric ID can rename or overwrite its filter configuration without any warning to the report's owner. This vulnerability is fixed in 17.3.2 and 17.4.0.

AnalysisAI

Missing authorization in OpenProject's CostReportsController allows any authenticated user to rename or overwrite the filter and grouping configuration of any Public cost report system-wide, bypassing ownership checks entirely. All OpenProject deployments running versions prior to 17.3.2 and 17.4.0 are affected. An attacker with only a low-privilege account who enumerates or guesses a public report's numeric ID can silently corrupt shared cost reporting configurations with no warning to the report's owner. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

OpenProject (CPE: cpe:2.3:a:opf:openproject:*:*:*:*:*:*:*:*) is a Ruby on Rails-based web project management platform. The vulnerability is rooted in CWE-862 (Missing Authorization): the CostReportsController's rename and update action handlers accept a report's numeric ID and apply modifications without verifying whether the requesting user owns the report or holds any elevated permission over it. The authorization gate present elsewhere in the application - which distinguishes between private reports and Public ones, and checks report ownership - is simply absent from these two controller actions. Public cost reports, intended to be visible to all authenticated users for collaborative review, become inadvertently mutable by any of those same users. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N correctly models this as a low-complexity, network-exploitable integrity violation requiring only a standard user session.

RemediationAI

Upgrade OpenProject to version 17.3.2 (stable branch) or 17.4.0 (next branch), both of which contain the authorization fix as confirmed by the vendor. The GitHub Security Advisory at https://github.com/opf/openproject/security/advisories/GHSA-c767-34gh-gh2h should be referenced for upgrade guidance and changelog details. If immediate upgrade is not feasible, a targeted compensating control is to restrict the creation and use of Public cost reports - converting existing Public reports to Private reduces the exploitable attack surface to zero for this specific flaw, since Private reports are not affected. This mitigation has the operational trade-off of breaking shared visibility workflows that teams depend on for collaborative financial reporting. Alternatively, network-layer access controls that restrict OpenProject access to trusted user segments (e.g., VPN-only, IP allowlist) reduce the pool of authenticated users who could exploit the missing authorization check, without altering report visibility settings.