What is the CVSS score of EUVD-2026-23870?

EUVD-2026-23870 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-23870?

Yes, a patch is available for EUVD-2026-23870. Update the affected software to the latest version immediately.

Openproject EUVD-2026-23870

| CVE-2026-40896 MEDIUM

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-04-20 GitHub_M

Code Injection Openproject

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 23, 2026 - 13:45 nvd

Patch available

Analysis Generated

Apr 20, 2026 - 16:23 vuln.today

Patch available

Apr 20, 2026 - 16:01 EUVD

EUVD ID Assigned

Apr 20, 2026 - 16:00 euvd

EUVD-2026-23870

Analysis Generated

Apr 20, 2026 - 16:00 vuln.today

CVE Published

Apr 20, 2026 - 15:12 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with manage_agendas permission in any project can inject agenda items into meetings belonging to any other project on the instance - even projects they have no access to. No knowledge of the target project, meeting, or victim is required; the attacker can blindly spray items into every meeting on the instance by iterating sequential section IDs. Version 17.3.0 patches the issue.

AnalysisAI

OpenProject versions prior to 17.3.0 allow authenticated users with manage_agendas permission in any single project to inject malicious agenda items into meetings across all other projects on the instance, including projects to which the attacker has no access. The vulnerability requires only valid project membership with limited permissions and no knowledge of target meetings, enabling an attacker to systematically compromise meeting integrity across an entire OpenProject deployment. No public exploit code has been identified, and the vendor has released patched version 17.3.0 addressing this privilege escalation flaw.

Technical ContextAI

OpenProject is a web-based project management platform written in Ruby on Rails that manages projects, teams, and meeting agendas. The vulnerability stems from insufficient access control in the agenda item injection mechanism, specifically a Time-of-Check-Time-of-Use (TOCTOU) race condition or improper authorization check (CWE-367) in the API or backend logic that handles agenda item creation. The flaw allows a user authenticated with manage_agendas permission in one project context to bypass project-level authorization checks and write agenda items to meeting objects in unrelated projects by directly referencing sequential section IDs without validating ownership or cross-project access. The affected product is identified via CPE cpe:2.3:a:opf:openproject, with all versions below 17.3.0 vulnerable. The attack surface is the agenda item creation endpoint, which likely accepts section IDs as direct input parameters without server-side verification that the requesting user has access to the target project.

RemediationAI

Vendor-released patch: OpenProject 17.3.0 or later. Organizations must upgrade immediately from any version below 17.3.0 to version 17.3.0 or the latest available release. Refer to the GitHub Security Advisory at https://github.com/opf/openproject/security/advisories/GHSA-hh5p-gwf8-h245 for detailed upgrade instructions and verification steps. As an interim workaround pending upgrade, administrators should audit access logs for agenda item creation activity and manually remove unauthorized agenda items from meetings across projects; additionally, restrict manage_agendas permission assignment to trusted users and audit existing role assignments for users with this permission in multiple projects. Note that the workaround is labor-intensive and does not prevent ongoing exploitation-patching is the only reliable mitigation. Organizations unable to upgrade immediately should disable agenda functionality entirely via feature flags if available, accepting reduced project management capability as a trade-off for preventing poisoning attacks.