Executive brief
OpenProject, a web-based project management platform, is affected by a critical security flaw in its baseline comparison feature. This feature allows users to view historical changes to project tasks and attributes. An attacker with basic user permissions could exploit this to gain unauthorized access to sensitive project data or modify information, potentially compromising the integrity of the entire project management system.
Technical details
A SQL injection vulnerability exists in OpenProject's baseline comparison functionality. The flaw is located within the handling of the 'timestamps' parameter, which is used to request historic work-package attributes. An authenticated attacker with low privileges can provide specially crafted input to this parameter to execute arbitrary SQL commands against the backend database. This could lead to full data exfiltration, unauthorized modification of records, and a partial impact on service availability. The vulnerability is addressed in versions 17.3.3 and 17.4.1.
Affected products
- opf OpenProject < 17.3.3, >= 17.4.0 < 17.4.1
Timeline
- 2026-06-08: advisory: Original GitHub security advisory published
- 2026-06-26: disclosed: NVD publication date
- 2026-06-08: patched: Fixes released in versions 17.3.3 and 17.4.1