# opf openproject. Every CVE that names opf openproject among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields](https://agentprime.io/advisories/CVE-2026-55095.md) `CVE-2026-55095` · CVE record: opf openproject · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Broken access control - [OpenProject: Private work package subject/identity disclosure through the global Time Entries and Cost Entries APIs (linked work package rendered without visibility check)](https://agentprime.io/advisories/CVE-2026-67529.md) `CVE-2026-67529` · CVE record: opf openproject · CVSS 4.3 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: Information disclosure, Broken access control - [OpenProject: Improper Access Control through /api/v3/custom_options/:id via Path "id" leads to Sensitive Data Exposure](https://agentprime.io/advisories/CVE-2026-67528.md) `CVE-2026-67528` · CVE record: opf openproject · CVSS 4.3 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: Broken access control - [OpenProject: Improper Access Control through /api/v3/work_packages/\ via PATCH parameter "fileLinks"](https://agentprime.io/advisories/CVE-2026-67527.md) `CVE-2026-67527` · CVE record: opf openproject · CVSS 7.6 High · Not analysed yet · Published 30 Jul 2026 · Tags: Broken access control - [OpenProject: Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass password requirements](https://agentprime.io/advisories/CVE-2026-44733.md) `CVE-2026-44733` · CVE record: opf openproject · CVSS 5.9 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-620 - [OpenProject: Improper Access Control on OpenProject through /projects/\[projectName\]/meetings via "invited_user_id" in GET parameter "filters" leads to user names disclosure](https://agentprime.io/advisories/CVE-2026-44731.md) `CVE-2026-44731` · CVE record: opf openproject · CVSS 4.3 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Broken access control - [OpenProject: IDOR on OpenProject through /api/v3/documents/{id} via PATCH parameter "project_id" leads to Unauthorized Modification of Resources](https://agentprime.io/advisories/CVE-2026-44732.md) `CVE-2026-44732` · CVE record: opf openproject · CVSS 4.3 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Broken access control - [OpenProject: Improper Access Control on OpenProject through the POST request to /projects/\[PROJECT_NAME\]/cost_reports/\[REPORT_ID\]/rename](https://agentprime.io/advisories/CVE-2026-44734.md) `CVE-2026-44734` · CVE record: opf openproject · CVSS 6.5 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Broken access control - [OpenProject: Shares API Information Disclosure](https://agentprime.io/advisories/CVE-2026-44735.md) `CVE-2026-44735` · CVE record: opf openproject · CVSS 6.5 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Broken access control - [OpenProject: Stored CSS injection via Sanitize::Config::RELAXED\[:css\] enables phishing overlays and data exfiltration](https://agentprime.io/advisories/CVE-2026-44696.md) `CVE-2026-44696` · CVE record: opf openproject · CVSS 5.7 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Cross-site scripting (XSS) - [OpenProject: Private work package data disclosure through single meeting agenda item API](https://agentprime.io/advisories/CVE-2026-49355.md) `CVE-2026-49355` · CVE record: opf openproject · CVSS 4.3 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Information disclosure, Broken access control - [OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects](https://agentprime.io/advisories/CVE-2026-44736.md) `CVE-2026-44736` · CVE record: opf openproject · CVSS 6.5 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Information disclosure, Broken access control, CWE-836 - [OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default \`SECRET_KEY_BASE=OVERWRITE_ME\` and \`cookies_serializer = :marshal\`](https://agentprime.io/advisories/CVE-2026-46386.md) `CVE-2026-46386` · CVE record: opf openproject · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: Insecure deserialization, Hard-coded credentials, CWE-1188, CWE-1392 - [OpenProject: Cache store poisoning leads to Remote Code Execution (RCE)](https://agentprime.io/advisories/CVE-2026-52780.md) `CVE-2026-52780` · CVE record: opf openproject · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-20 - [OpenProject: Cross-project authorization bypass allows deleting public Calendar and Team Planner queries from unauthorized projects](https://agentprime.io/advisories/CVE-2026-52779.md) `CVE-2026-52779` · CVE record: opf openproject · CVSS 5.4 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Broken access control - [OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks](https://agentprime.io/advisories/CVE-2026-47193.md) `CVE-2026-47193` · CVE record: opf openproject · CVSS 7.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: Information disclosure, Broken access control - [OpenProject: Stored XSS on openproject.example.com through /api/v3/projects/{project}/work_packages via POST parameter "description"](https://agentprime.io/advisories/CVE-2026-52781.md) `CVE-2026-52781` · CVE record: opf openproject · CVSS 6.4 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Cross-site scripting (XSS) - [OpenProject: IDOR through /projects/\/settings/project_storages/\ via PATCH parameter "storages_project_storage\[project_folder_id\]" leads to Access to Unauthorized Resources](https://agentprime.io/advisories/CVE-2026-52782.md) `CVE-2026-52782` · CVE record: opf openproject · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: Broken access control - [OpenProject: Information Disclosure (cleartext storage of data) on localhost through memcached via Others "storage.\.httpx_access_token" leads to Sensitive Data Exposure](https://agentprime.io/advisories/CVE-2026-52783.md) `CVE-2026-52783` · CVE record: opf openproject · CVSS 8.2 High · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-313 - [OpenProject: CSRF on TARGET through /users/:id via POST parameter "user\[admin\]"](https://agentprime.io/advisories/CVE-2026-52784.md) `CVE-2026-52784` · CVE record: opf openproject · CVSS 8.8 High · Not analysed yet · Published 26 Jun 2026 · Tags: Cross-site request forgery (CSRF) - [OpenProject: SQL injection in timestamps functionality](https://agentprime.io/advisories/CVE-2026-52785.md) `CVE-2026-52785` · CVE record: opf openproject · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: SQL injection - [OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup](https://agentprime.io/advisories/CVE-2026-40896.md) `CVE-2026-40896` · CVE record: opf openproject · CVSS 6.5 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Race condition, Broken access control - [OpenProject: 2FA OTP Verification Missing Rate Limiting](https://agentprime.io/advisories/CVE-2026-33667.md) `CVE-2026-33667` · CVE record: opf openproject · CVSS 7.4 High · Not analysed yet · Published 15 Apr 2026 · Tags: Authentication bypass - [OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string](https://agentprime.io/advisories/CVE-2026-34717.md) `CVE-2026-34717` · CVE record: opf openproject · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Apr 2026 · Tags: SQL injection - [OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policy](https://agentprime.io/advisories/CVE-2026-32703.md) `CVE-2026-32703` · CVE record: opf openproject · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Mar 2026 · Tags: Cross-site scripting (XSS) - [OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-32698.md) `CVE-2026-32698` · CVE record: opf openproject · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Mar 2026 · Tags: SQL injection - [Blind SSRF on OpenProject instance via webhooks](https://agentprime.io/advisories/CVE-2026-31974.md) `CVE-2026-31974` · CVE record: opf openproject · CVSS 3.0 Low · Not analysed yet · Published 11 Mar 2026 · Tags: Server-side request forgery (SSRF) - [OpenProject has a Permission Check bypass on Budget deletion allows reassignment of WorkPackages into other budgets](https://agentprime.io/advisories/CVE-2026-30239.md) `CVE-2026-30239` · CVE record: opf openproject · CVSS 6.5 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: Broken access control - [OpenProject users that are not project members can be used to calculate Labor Budget, leaking their global hourly rate](https://agentprime.io/advisories/CVE-2026-30236.md) `CVE-2026-30236` · CVE record: opf openproject · CVSS 4.3 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: Broken access control - [Business Logic Error on OpenProject through hyperlinks in markdown using DOM clobbering](https://agentprime.io/advisories/CVE-2026-30235.md) `CVE-2026-30235` · CVE record: opf openproject · CVSS 6.5 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: Cross-site scripting (XSS) - [OpenProject BIM BCF XML Import: \ Path Traversal Leads to Arbitrary Local File Read (AFR)](https://agentprime.io/advisories/CVE-2026-30234.md) `CVE-2026-30234` · CVE record: opf openproject · CVSS 6.5 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: Path traversal - [OpenProject: Insufficient access control leads to create Wiki objects belongs unpermitted projects](https://agentprime.io/advisories/CVE-2026-27723.md) `CVE-2026-27723` · CVE record: opf openproject · CVSS 4.3 Medium · Not analysed yet · Published 5 Mar 2026 · Tags: Broken access control - [OpenProject has Improper Access Control on User Management allows user managers to lock admin accounts](https://agentprime.io/advisories/CVE-2026-24777.md) `CVE-2026-24777` · CVE record: opf openproject · CVSS 6.7 Medium · Not analysed yet · Published 9 Feb 2026 · Tags: Broken access control - [Command Injection on OpenProject repositories leads to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-25763.md) `CVE-2026-25763` · CVE record: opf openproject · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Feb 2026 · Tags: Command injection - [OpenProject vulnerable to Stored HTML injection](https://agentprime.io/advisories/CVE-2026-25764.md) `CVE-2026-25764` · CVE record: opf openproject · CVSS 3.5 Low · Not analysed yet · Published 6 Feb 2026 · Tags: Cross-site scripting (XSS) - [OpenProject has an IDOR on MeetingAgendaItems allows cross-project meeting agenda item transfer](https://agentprime.io/advisories/CVE-2026-24776.md) `CVE-2026-24776` · CVE record: opf openproject · CVSS 4.3 Medium · Not analysed yet · Published 6 Feb 2026 · Tags: Broken access control - [OpenProject has Forced Actions, Content Spoofing, and Persistent DoS via ID Manipulation in OpenProject Blocknote Editor Extension](https://agentprime.io/advisories/CVE-2026-24775.md) `CVE-2026-24775` · CVE record: opf openproject · CVSS 6.3 Medium · Not analysed yet · Published 28 Jan 2026 · Tags: CWE-345 - [OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server](https://agentprime.io/advisories/CVE-2026-24772.md) `CVE-2026-24772` · CVE record: opf openproject · CVSS 8.9 High · Not analysed yet · Published 28 Jan 2026 · Tags: CWE-345 - [OpenProject has Argument Injection on Repository module that allows Arbitrary File Write](https://agentprime.io/advisories/CVE-2026-24685.md) `CVE-2026-24685` · CVE record: opf openproject · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Jan 2026 · Tags: Command injection - [OpenProject users with "View Members" permission in any project can view all Group memberships](https://agentprime.io/advisories/CVE-2026-23721.md) `CVE-2026-23721` · CVE record: opf openproject · CVSS 4.3 Medium · Not analysed yet · Published 19 Jan 2026 · Tags: Broken access control - [OpenProject users can delete other user's session, causing them to be logged out](https://agentprime.io/advisories/CVE-2026-23646.md) `CVE-2026-23646` · CVE record: opf openproject · CVSS 6.5 Medium · Not analysed yet · Published 19 Jan 2026 · Tags: CWE-488 - [OpenProject has stored XSS regression using attachments and script-src self](https://agentprime.io/advisories/CVE-2026-23625.md) `CVE-2026-23625` · CVE record: opf openproject · CVSS 8.7 High · Not analysed yet · Published 19 Jan 2026 · Tags: Cross-site scripting (XSS) - [OpenProject is Vulnerable to Insecure Direct Object Reference in Meetings](https://agentprime.io/advisories/CVE-2026-22605.md) `CVE-2026-22605` · CVE record: opf openproject · CVSS 4.3 Medium · Not analysed yet · Published 10 Jan 2026 · Tags: Broken access control - [OpenProject is vulnerable to user enumeration via the change password function](https://agentprime.io/advisories/CVE-2026-22604.md) `CVE-2026-22604` · CVE record: opf openproject · CVSS 6.9 Medium · Not analysed yet · Published 10 Jan 2026 · Tags: Information disclosure - [OpenProject has no protection against brute-force attacks in the Change Password function](https://agentprime.io/advisories/CVE-2026-22603.md) `CVE-2026-22603` · CVE record: opf openproject · CVSS 6.9 Medium · Not analysed yet · Published 10 Jan 2026 · Tags: Authentication bypass - [OpenProject is Vulnerable to User Enumeration via User ID](https://agentprime.io/advisories/CVE-2026-22602.md) `CVE-2026-22602` · CVE record: opf openproject · CVSS 3.5 Low · Not analysed yet · Published 10 Jan 2026 · Tags: Information disclosure - [OpenProject is Vulnerable to Code Execution in E-Mail function](https://agentprime.io/advisories/CVE-2026-22601.md) `CVE-2026-22601` · CVE record: opf openproject · CVSS 8.6 High · Not analysed yet · Published 10 Jan 2026 · Tags: Command injection - [OpenProject is Vulnerable to Arbitrary File Read via ImageMagick SVG Coder](https://agentprime.io/advisories/CVE-2026-22600.md) `CVE-2026-22600` · CVE record: opf openproject · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jan 2026 · Tags: Information disclosure - [OpenProject stored HTML injection vulnerability](https://agentprime.io/advisories/CVE-2025-24892.md) `CVE-2025-24892` · CVE record: opf openproject · CVSS 3.5 Low · Not analysed yet · Published 10 Feb 2025 · Tags: Cross-site scripting (XSS) - [OpenProject packaged installation has Open Redirect Vulnerability in Sign-In in default configuration](https://agentprime.io/advisories/CVE-2024-41801.md) `CVE-2024-41801` · CVE record: opf openproject · CVSS 4.7 Medium · Not analysed yet · Published 25 Jul 2024 · Tags: Open redirect - [Stored Cross-Site Scripting (XSS) in OpenProject](https://agentprime.io/advisories/CVE-2024-35224.md) `CVE-2024-35224` · CVE record: opf openproject · CVSS 7.6 High · Not analysed yet · Published 23 May 2024 · Tags: Cross-site scripting (XSS) - [OpenProject vulnerable to project identifier information leakage through robots.txt](https://agentprime.io/advisories/CVE-2023-33960.md) `CVE-2023-33960` · CVE record: opf openproject · CVSS 7.5 High · Not analysed yet · Published 1 Jun 2023 · Tags: Information disclosure - [OpenProject user sessions not terminated after activation of 2FA](https://agentprime.io/advisories/CVE-2023-31140.md) `CVE-2023-31140` · CVE record: opf openproject · CVSS 4.8 Medium · Not analysed yet · Published 8 May 2023 · Tags: Authentication bypass - [SQL injection in OpenProject](https://agentprime.io/advisories/CVE-2021-43830.md) `CVE-2021-43830` · CVE record: opf openproject · CVSS 7.4 High · Not analysed yet · Published 14 Dec 2021 · Tags: SQL injection - [Regular Expression Denial of Service in OpenProject forum messages](https://agentprime.io/advisories/CVE-2021-32763.md) `CVE-2021-32763` · CVE record: opf openproject · CVSS 4.3 Medium · Not analysed yet · Published 20 Jul 2021 · Tags: Denial of service ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .