OpenProject EUVD-2026-39871

The attacker must hold a low-privilege authenticated account in the target OpenProject instance with at minimum the permission to edit work package descriptions in at least one project (typically Contributor or Member role). The attacker must also be able to upload attachments to the OpenProject instance, as the malicious Turbo Stream payload is hosted as an uploaded file. Exploitation of victim sessions requires those victims to navigate to and load the affected work package in a browser - they need not click any link or perform any further action once on the page. Exploitation is limited to the scope of users who have view access to the affected work package. Deployments where all project members are fully trusted internal users are at significantly lower risk. The <macro> element support and Stimulus.js/Turbo Streams integration are standard components of OpenProject's default web interface and are not non-default configurations.

The official CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N scores 6.4, and the S:C (scope change) reflects the cross-user nature of stored XSS correctly. However, the UI:N designation warrants scrutiny: a victim must navigate to the affected work package, which under NVD guidance typically qualifies as UI:R; accepting UI:N inflates the score slightly. Setting UI:R yields approximately 5.4 but does not reduce the operational threat. The PR:L requirement is the primary limiting factor - exploitation is gated on authenticated contributor-level access, excluding unauthenticated internet-based attacks. The scope change combined with no-victim-action-beyond-page-load means a single injected payload propagates to all project members who view the work package, amplifying blast radius in collaborative environments. EPSS data was not provided in the input and exploitation probability cannot be independently quantified here. No CISA KEV listing and no public POC exist at time of analysis, making this a credible but not confirmed-exploited threat. Real-world priority is elevated for multi-tenant OpenProject deployments where external collaborators or untrusted project members have edit access to work packages; low for tightly controlled internal-only deployments.

An authenticated OpenProject project member with contributor-level access edits a work package description and injects <macro data-controller="poll-for-changes" data-poll-for-changes-url-value="/api/v3/attachments/ATTACKER_ID/content"> pointing to a previously uploaded attachment containing crafted Turbo Stream markup with a redirect_to action targeting an attacker-controlled phishing server. When any other project member opens the work package in their browser, Stimulus.js silently mounts the poll-for-changes controller, fetches the malicious attachment, and renderStreamMessage() executes the redirect, sending the victim's authenticated session context to the attacker's server. No public POC is available at time of analysis, but the vulnerability mechanism is fully described in the advisory.