opf openproject.

OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields

• opf openproject
• Broken access control

OpenProject: Private work package subject/identity disclosure through the global Time Entries and Cost Entries APIs (linked work package rendered without visibility check)

• opf openproject
• Information disclosure
• Broken access control

OpenProject: Improper Access Control through /api/v3/custom_options/:id via Path "id" leads to Sensitive Data Exposure

• opf openproject
• Broken access control

OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks"

• opf openproject
• Broken access control

OpenProject: Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass password requirements

• opf openproject
• CWE-620

OpenProject: Improper Access Control on OpenProject through /projects/[projectName]/meetings via "invited_user_id" in GET parameter "filters" leads to user names disclosure

• opf openproject
• Broken access control

OpenProject: IDOR on OpenProject through /api/v3/documents/{id} via PATCH parameter "project_id" leads to Unauthorized Modification of Resources

• opf openproject
• Broken access control

OpenProject: Improper Access Control on OpenProject through the POST request to /projects/[PROJECT_NAME]/cost_reports/[REPORT_ID]/rename

• opf openproject
• Broken access control

OpenProject: Shares API Information Disclosure

• opf openproject
• Broken access control

OpenProject: Stored CSS injection via Sanitize::Config::RELAXED[:css] enables phishing overlays and data exfiltration

• opf openproject
• Cross-site scripting (XSS)

OpenProject: Private work package data disclosure through single meeting agenda item API

• opf openproject
• Information disclosure
• Broken access control

OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects

• opf openproject
• Information disclosure
• Broken access control

OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`

• opf openproject
• Insecure deserialization
• Hard-coded credentials

OpenProject: Cache store poisoning leads to Remote Code Execution (RCE)

• opf openproject
• CWE-20

OpenProject: Cross-project authorization bypass allows deleting public Calendar and Team Planner queries from unauthorized projects

• opf openproject
• Broken access control

OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks

• opf openproject
• Information disclosure
• Broken access control

OpenProject: Stored XSS on openproject.example.com through /api/v3/projects/{project}/work_packages via POST parameter "description"

• opf openproject
• Cross-site scripting (XSS)

OpenProject: IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[project_folder_id]" leads to Access to Unauthorized Resources

• opf openproject
• Broken access control

OpenProject: Information Disclosure (cleartext storage of data) on localhost through memcached via Others "storage.<id>.httpx_access_token" leads to Sensitive Data Exposure

• opf openproject
• CWE-313

OpenProject: CSRF on TARGET through /users/:id via POST parameter "user[admin]"

• opf openproject
• Cross-site request forgery (CSRF)

OpenProject: SQL injection in timestamps functionality

• opf openproject
• SQL injection

OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup

• opf openproject
• Race condition
• Broken access control

OpenProject: 2FA OTP Verification Missing Rate Limiting

• opf openproject
• Authentication bypass

OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string

• opf openproject
• SQL injection

OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policy

• opf openproject
• Cross-site scripting (XSS)

OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution

• opf openproject
• SQL injection

Blind SSRF on OpenProject instance via webhooks

• opf openproject
• Server-side request forgery (SSRF)

OpenProject has a Permission Check bypass on Budget deletion allows reassignment of WorkPackages into other budgets

• opf openproject
• Broken access control

OpenProject users that are not project members can be used to calculate Labor Budget, leaking their global hourly rate

• opf openproject
• Broken access control

Business Logic Error on OpenProject through hyperlinks in markdown using DOM clobbering

• opf openproject
• Cross-site scripting (XSS)

OpenProject BIM BCF XML Import: <Snapshot> Path Traversal Leads to Arbitrary Local File Read (AFR)

• opf openproject
• Path traversal

OpenProject: Insufficient access control leads to create Wiki objects belongs unpermitted projects

• opf openproject
• Broken access control

OpenProject has Improper Access Control on User Management allows user managers to lock admin accounts

• opf openproject
• Broken access control

Command Injection on OpenProject repositories leads to Remote Code Execution

• opf openproject
• Command injection

OpenProject vulnerable to Stored HTML injection

• opf openproject
• Cross-site scripting (XSS)

OpenProject has an IDOR on MeetingAgendaItems allows cross-project meeting agenda item transfer

• opf openproject
• Broken access control

OpenProject has Forced Actions, Content Spoofing, and Persistent DoS via ID Manipulation in OpenProject Blocknote Editor Extension

• opf openproject
• CWE-345

OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server

• opf openproject
• CWE-345

OpenProject has Argument Injection on Repository module that allows Arbitrary File Write

• opf openproject
• Command injection

OpenProject users with "View Members" permission in any project can view all Group memberships

• opf openproject
• Broken access control

OpenProject users can delete other user's session, causing them to be logged out

• opf openproject
• CWE-488

OpenProject has stored XSS regression using attachments and script-src self

• opf openproject
• Cross-site scripting (XSS)

OpenProject is Vulnerable to Insecure Direct Object Reference in Meetings

• opf openproject
• Broken access control

OpenProject is vulnerable to user enumeration via the change password function

• opf openproject
• Information disclosure

OpenProject has no protection against brute-force attacks in the Change Password function

• opf openproject
• Authentication bypass

OpenProject is Vulnerable to User Enumeration via User ID

• opf openproject
• Information disclosure

OpenProject is Vulnerable to Code Execution in E-Mail function

• opf openproject
• Command injection

OpenProject is Vulnerable to Arbitrary File Read via ImageMagick SVG Coder

• opf openproject
• Information disclosure

OpenProject stored HTML injection vulnerability

• opf openproject
• Cross-site scripting (XSS)

OpenProject packaged installation has Open Redirect Vulnerability in Sign-In in default configuration

• opf openproject
• Open redirect

Stored Cross-Site Scripting (XSS) in OpenProject

• opf openproject
• Cross-site scripting (XSS)

OpenProject vulnerable to project identifier information leakage through robots.txt

• opf openproject
• Information disclosure

OpenProject user sessions not terminated after activation of 2FA

• opf openproject
• Authentication bypass

SQL injection in OpenProject

• opf openproject
• SQL injection

Regular Expression Denial of Service in OpenProject forum messages

• opf openproject
• Denial of service