OpenProject CVE-2026-52785

Requires an authenticated account on the target OpenProject instance (CVSS PR:L) and the ability to invoke the baseline-comparison feature that accepts the timestamps parameter for requesting historic work-package attributes - that timestamps parameter is the exact injection point. No user interaction is needed (UI:N) and the attack is fully network-based (AV:N) with low complexity (AC:L). Limiting factors: the attacker must be able to log in, so instances that disable self-registration and restrict accounts to trusted users meaningfully reduce exposure, and only versions before 17.3.3 / 17.4.1 are affected - patched instances are not exploitable.

Signals are strong but with one caveat. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L = 9.9) indicates network-reachable, low-complexity exploitation requiring only a low-privileged authenticated account, with a scope change reflecting impact on the database beyond the web app's security boundary. PR:L means this is NOT unauthenticated - any registered/low-privileged user (common in collaborative project tools with open or self-registration) is enough, which materially raises real-world exposure for internet-facing instances. No EPSS score, no CISA KEV listing, and no POC were provided, so there is no evidence of active exploitation or weaponization yet; this is a high-priority patch based on severity and ease of exploitation by authenticated users, not on observed in-the-wild activity. The CVSS-assigned S:C (scope change) is plausible for SQLi reaching the DBMS but should be confirmed against the vendor advisory, as scope on SQLi is frequently scored conservatively.

An attacker who holds (or self-registers for) a low-privileged OpenProject account opens a work-package baseline comparison and intercepts the request, replacing the timestamps parameter with a crafted SQL payload. The injected query runs against the OpenProject database, letting the attacker read other users' or projects' data and potentially modify records (I:H), all over the network with low complexity and no user interaction. No public POC was provided, but the low barrier (PR:L, AC:L) makes development straightforward for a motivated authenticated attacker.