Executive brief
OpenProject is a web-based project management platform used for tracking tasks and costs. A security flaw allows any logged-in user to rename or change the settings of public cost reports created by other users. This could lead to unauthorized data modification and disruption of financial reporting within the organization.
Technical details
A missing authorization vulnerability (CWE-862) exists in the CostReportsController of OpenProject. The 'rename' and 'update' actions fail to verify if the requesting user has the appropriate ownership or permission levels before modifying a report. An authenticated attacker can exploit this by sending a crafted POST request to the cost report endpoints if they can guess or discover the numeric ID of a public report. This allows the attacker to overwrite filter configurations, groupings, and report names. The issue is resolved in versions 17.3.2 and 17.4.0.
Affected products
- opf OpenProject < 17.3.2, < 17.4.0
Timeline
- 2026-05-13: advisory: Initial GitHub advisory published
- 2026-06-26: disclosed: NVD publication date