EUVD-2026-39873Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Network-accessible web app, low complexity IDOR; PR:L because management role in any one project is required; no confidentiality impact as only deletion is possible.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, a cross-project IDOR / authorization context confusion in the Calendar and Team Planner modules allows a user with management permissions in one project to delete public Calendar or Team Planner Queries from another project where they do not have the corresponding management permissions. Both modules authorize the request against the project identified by :project_id in the URL, but the actual Query object is loaded later by :id from Query.visible(current_user) without verifying that the loaded Query belongs to the authorized project. As a result, an attacker can use permissions from Project A to delete shared/public Calendar or Team Planner views from Project B, causing integrity impact and limited availability impact for users relying on those shared views. This vulnerability is fixed in 17.3.3 and 17.4.1.
AnalysisAI
Cross-project IDOR in OpenProject's Calendar and Team Planner modules allows an authenticated low-privileged user with management rights in one project to delete public or shared Calendar and Team Planner Query views belonging to entirely separate projects on the same instance. The authorization context is established using :project_id from the URL (Project A), but the targeted Query object is resolved independently by :id through Query.visible(current_user), with no check that the loaded Query belongs to the authorized project - enabling cross-project privilege misuse. Versions prior to 17.3.3 and 17.4.1 are affected; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Technical ContextAI
OpenProject (CPE: cpe:2.3:a:opf:openproject:*:*:*:*:*:*:*:*) is an open-source Ruby on Rails web application for project management. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the Calendar and Team Planner controllers perform their permission check against the :project_id URL parameter, granting the request context of Project A's permissions. However, the Query model is subsequently loaded via a separate :id parameter using the scope Query.visible(current_user), which only checks whether the query is visible to the user in general - not whether it belongs to the project already authorized. This decoupled two-phase lookup means the authorization boundary (project context) and the resource scope (which query is acted on) are never reconciled, a textbook IDOR pattern where a user-controlled key (:id) bypasses the intended object-level authorization. The impact is limited to deletion operations on public or shared Calendar and Team Planner views, with no read/exfiltration path identified in the description.
RemediationAI
Upgrade OpenProject to version 17.3.3 (stable channel) or 17.4.1 (current channel), which contain the fix for this vulnerability per the vendor advisory at https://github.com/opf/openproject/security/advisories/GHSA-jrx5-px3f-vfq4. If immediate upgrading is not feasible, a compensating control is to audit and restrict management-role assignments across projects, ensuring only fully trusted users hold project management permissions - this reduces the attacker population since exploitation requires that role. Administrators can also review and audit shared public Calendar and Team Planner queries for unexpected deletions. Disabling the Calendar or Team Planner modules entirely via OpenProject's module configuration would eliminate the attack surface for those specific modules, though this has the trade-off of removing planning functionality for all users. No network-layer controls (WAF, firewall rules) will reliably prevent exploitation since the attack uses standard authenticated HTTP requests to legitimate API endpoints.
More in Openproject
View allA SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbi
OpenProject is web-based project management software. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
OpenProject is open source project management software. Rated medium severity (CVSS 6.5), this vulnerability is remotely
Authenticated remote code execution affects the official openproject/openproject Docker image, which ships with a hardco
Cross-project folder hijacking in OpenProject before 17.3.3 and 17.4.1 lets a project-admin abuse an insecure direct obj
SQL injection in OpenProject's baseline-comparison (timestamps) functionality lets an authenticated, low-privileged user
OpenProject has a CVSS 9.9 command injection vulnerability allowing authenticated users to execute OS commands on the pr
Remote code execution in OpenProject before 17.3.3 and 17.4.1 arises from cache store poisoning, allowing an attacker wi
OpenProject, a web-based project management platform, contains a critical SQL injection vulnerability in versions prior
OpenProject (before 16.6.4) has a local file read vulnerability through SVG-based ImageMagick exploitation in the PDF ex
OpenProject's Repositories module contains a stored cross-site scripting (XSS) vulnerability that occurs when displaying
Token decryption in OpenProject 17.0 allows authenticated attackers to intercept and decrypt 24-hour authentication toke
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today