What is the CVSS score of CVE-2026-52785?

CVE-2026-52785 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.2%.

Which versions of OpenProject are affected by CVE-2026-52785?

OpenProject contains a critical SQL injection vulnerability (CVE-2026-52785, CVSS 9.9) in its baseline-comparison timestamps feature that allows any authenticated user-even those with low privilege…. A patch is available.

How to fix or mitigate CVE-2026-52785?

Within 24 hours: Inventory all OpenProject instances and identify which version lines are deployed (17.3.x vs 17.4.x); document user roles with database access or low-privilege account provisioning patterns. Within 7 days: Apply vendor patches (upgrade to OpenProject 17.3.3 or 17.4.1 depending on your version line); restart all instances post-deployment. Within 30 days: Audit database logs for anomalous SQL patterns between deployment date and patch application; audit user accounts for unauthorized access patterns or privilege escalation attempts.

OpenProject CVE-2026-52785

EUVD-2026-39867 CRITICAL

SQL Injection (CWE-89)

2026-06-26 GitHub_M

SQLi Openproject

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

vuln.today AI

8.3 HIGH

Network-reachable SQLi exploitable by any authenticated low-priv user (PR:L, AC:L, UI:N) giving database read and write; I score scope unchanged as the injection stays within the app's own DBMS, where the provided vector used S:C.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Jun 26, 2026 - 21:02 EUVD

Analysis Generated

Jun 26, 2026 - 19:45 vuln.today

DescriptionCVE.org

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is a SQL injection in timestamps functionality. OpenProject baseline comparison allows callers to request historic work-package attributes using the timestamps parameter. This vulnerability is fixed in 17.3.3 and 17.4.1.

AnalysisAI

SQL injection in OpenProject's baseline-comparison (timestamps) functionality lets an authenticated, low-privileged user inject SQL through the timestamps parameter used to request historic work-package attributes, affecting all versions prior to 17.3.3 and 17.4.1. Rated CVSS 9.9 with a changed scope, it can expose or alter database contents beyond the user's normal authorization. No public exploit identified at time of analysis; the issue is fixed in 17.3.3 and 17.4.1.

Technical ContextAI

OpenProject is a Ruby on Rails open-source, web-based project management application (CPE cpe:2.3:a:opf:openproject). The flaw is a classic CWE-89 SQL Injection: the baseline-comparison feature lets callers ask for the state of work-package attributes 'as of' a point in time via the timestamps parameter, and that user-supplied timestamp value is incorporated into a database query without adequate parameterization/validation. Because work-package history queries run against the core application database, injected SQL executes in the context of the application's DB account, allowing reading and tampering of data the requesting user should not be able to reach.

RemediationAI

Vendor-released patch: 17.3.3 and 17.4.1 - upgrade to 17.3.3 if you are on the 17.3.x branch, or to 17.4.1 if you are on the 17.4.x branch (or later), following the GHSA-98vw-2r87-fx2r advisory at https://github.com/opf/openproject/security/advisories/GHSA-98vw-2r87-fx2r. Because exploitation requires an authenticated low-privileged account, interim compensating controls until patching include disabling open/self-service user registration and pruning untrusted accounts to shrink the pool of potential attackers, and restricting network access to the OpenProject instance (VPN/IP allowlist) so it is not broadly internet-reachable - both reduce who can reach the vulnerable timestamps endpoint at the cost of convenience for legitimate external collaborators. A WAF rule inspecting the timestamps parameter for SQL metacharacters can offer shallow mitigation but is easily bypassed and may break legitimate baseline-comparison requests, so treat it only as a stopgap; upgrading is the only reliable fix.