CVE-2026-40896
OpenProject is open-source, web-based project management software.
Published Apr 20, 2026 · updated Jun 17, 2026 · openproject openproject
OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with permission in any project can inject agenda items into meetings belonging to any other project on the instance — even projects they have no access to. No knowledge of the target project, meeting, or victim is required; the attacker can blindly spray items into every meeting on the instance by iterating sequential section IDs. Version 17.3.0 patches the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 20, 2026 · NIST NVD
Detected
OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with permission in any project can inject agenda items into meetings belonging to any other project on the instance — even projects they have no access to. No knowledge of the target project, meeting, or victim is required; the attacker can blindly spray items into every meeting on the instance by it
Jun 17, 2026 · NIST NVD
Updated
OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with permission in any project can inject agenda items into meetings belonging to any other project on the instance — even projects they have no access to. No knowledge of the target project, meeting, or victim is required; the attacker can blindly spray items into every meeting on the instance by it
Affected
- cpe openproject/openprojectversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-40896
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-40896
OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with permission in any project can inject agenda items into meetings belonging to any other project on the instance — even projects they have no access to. No knowl
nvd.nist.gov