opf openproject vulnerabilities

CVEs per yearBy the year they were published

1. 20212
2. 20232
3. 20242
4. 20251
5. 202648

Newest CVEs

• CVE-2026-55095

  OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields

  opf · openproject

  Medium5.3
• CVE-2026-67529

  OpenProject: Private work package subject/identity disclosure through the global Time Entries and Cost Entries APIs (linked work package rendered without visibility check)

  opf · openproject

  Medium4.3
• CVE-2026-67528

  OpenProject: Improper Access Control through /api/v3/custom_options/:id via Path "id" leads to Sensitive Data Exposure

  opf · openproject

  Medium4.3
• CVE-2026-67527

  OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks"

  opf · openproject

  High7.6
• CVE-2026-44733

  OpenProject: Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass password requirements

  opf · openproject

  Medium5.9
• CVE-2026-44731

  OpenProject: Improper Access Control on OpenProject through /projects/[projectName]/meetings via "invited_user_id" in GET parameter "filters" leads to user names disclosure

  opf · openproject

  Medium4.3
• CVE-2026-44732

  OpenProject: IDOR on OpenProject through /api/v3/documents/{id} via PATCH parameter "project_id" leads to Unauthorized Modification of Resources

  opf · openproject

  Medium4.3
• CVE-2026-44734

  OpenProject: Improper Access Control on OpenProject through the POST request to /projects/[PROJECT_NAME]/cost_reports/[REPORT_ID]/rename

  opf · openproject

  Medium6.5
• CVE-2026-44735

  OpenProject: Shares API Information Disclosure

  opf · openproject

  Medium6.5
• CVE-2026-44696

  OpenProject: Stored CSS injection via Sanitize::Config::RELAXED[:css] enables phishing overlays and data exfiltration

  opf · openproject

  Medium5.7