Auth bypass in Openproject
CVE-2026-24776
OpenProject is an open-source, web-based project management software. Prior to 17.0.2, the drag&drop handler moving an agenda item to a different section was not properly checking if the target meeting section is part of the same meeting (or is the backlog, in case of recurring meetings). This allowed an attacker to move a meeting agenda item into a different meeting. The attacker did not get access to meetings, but they could add arbitrary agenda items, that could cause confusions. The vulnerability is fixed in 17.0.2.
Vulnerability class: IDOR (Insecure Direct Object Reference)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.002 (9.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 9th percentile — 9.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: +0.000
Affected products
- Openproject
- Opf Openproject — versions < 17.0.2
Weakness classification (CWE)
References
- github.com/opf/openproject/security/advisories/GHSA-p9v8-w9ph-hqmf (Vendor Advisory)
- github.com/opf/openproject/releases/tag/v17.0.2 (Release Notes)
Frequently asked questions
- What is CVE-2026-24776?
- CVE-2026-24776 is a medium-severity vulnerability in Openproject, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.3/10. Published 2026-02-06.
- How severe is CVE-2026-24776?
- Medium severity. CVSS v3 base score is 4.3 out of 10.