What is the CVSS score of CVE-2026-52780?

CVE-2026-52780 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Openproject are affected by CVE-2026-52780?

OpenProject installations running versions before 17.3.3 and 17.4.1 face critical remote code execution risk from unauthenticated attackers on the same network segment, with complete system…. A patch is available.

How to fix or mitigate CVE-2026-52780?

Within 24 hours: Audit all deployed OpenProject instances for version numbers and confirm network exposure status. Within 7 days: Implement network segmentation to restrict OpenProject access to authorized users and systems; enable detailed monitoring and alerting for suspicious access patterns on affected systems. Within 30 days: Monitor vendor security advisories for patches (expected versions 17.3.3 or 17.4.1); establish rapid deployment procedures to apply patches immediately upon release.

Openproject CVE-2026-52780

EUVD-2026-39874 CRITICAL

Improper Input Validation (CWE-20)

2026-06-26 GitHub_M

RCE Openproject

9.6

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.6 CRITICAL

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 26, 2026 - 21:02 EUVD

Analysis Generated

Jun 26, 2026 - 19:49 vuln.today

DescriptionCVE.org

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, cache store poisoning leads to Remote Code Execution (RCE). This vulnerability is fixed in 17.3.3 and 17.4.1.

AnalysisAI

Remote code execution in OpenProject before 17.3.3 and 17.4.1 arises from cache store poisoning, allowing an attacker with adjacent-network access and no authentication (CVSS:3.1 AV:A/PR:N) to corrupt cached entries and ultimately execute arbitrary code on the server. The CVSS 9.6 score reflects a scope change (S:C) with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.