CVE-2026-30239

OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when budgets are deleted, the work packages that were assigned to this budget need to be moved to a different budget. This action was performed before the permission check on the delete action was executed. This allowed all users in the application to delete work package budget assignments. This vulnerability is fixed in 17.2.0.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/opf/openproject/security/advisories/GHSA-gpvh-g967-g4h8	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*

History

13 Mar 2026, 19:01

Type	Values Removed	Values Added
Summary		(es) OpenProject es un software de gestión de proyectos de código abierto y basado en la web. Antes de la versión 17.2.0, cuando se eliminan presupuestos, los paquetes de trabajo que estaban asignados a ese presupuesto deben ser movidos a un presupuesto diferente. Esta acción se realizaba antes de que se ejecutara la verificación de permisos sobre la acción de eliminación. Esto permitía a todos los usuarios de la aplicación eliminar las asignaciones de presupuesto de los paquetes de trabajo. Esta vulnerabilidad se corrige en la versión 17.2.0.
First Time		Openproject openproject Openproject
CPE		cpe:2.3:a:openproject:openproject::::::::
References	~~() https://github.com/opf/openproject/security/advisories/GHSA-gpvh-g967-g4h8 -~~	() https://github.com/opf/openproject/security/advisories/GHSA-gpvh-g967-g4h8 - Vendor Advisory

11 Mar 2026, 17:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-11 17:16

Updated : 2026-03-13 19:01

NVD link : CVE-2026-30239

Mitre link : CVE-2026-30239

CVE.ORG link : CVE-2026-30239

JSON object : View

Products Affected

openproject

openproject

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-30239", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "published": "2026-03-11T17:16:57.773", "references": [{"url": "https://github.com/opf/openproject/security/advisories/GHSA-gpvh-g967-g4h8", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when budgets are deleted, the work packages that were assigned to this budget need to be moved to a different budget. This action was performed before the permission check on the delete action was executed. This allowed all users in the application to delete work package budget assignments. This vulnerability is fixed in 17.2.0."}, {"lang": "es", "value": "OpenProject es un software de gesti\u00f3n de proyectos de c\u00f3digo abierto y basado en la web. Antes de la versi\u00f3n 17.2.0, cuando se eliminan presupuestos, los paquetes de trabajo que estaban asignados a ese presupuesto deben ser movidos a un presupuesto diferente. Esta acci\u00f3n se realizaba antes de que se ejecutara la verificaci\u00f3n de permisos sobre la acci\u00f3n de eliminaci\u00f3n. Esto permit\u00eda a todos los usuarios de la aplicaci\u00f3n eliminar las asignaciones de presupuesto de los paquetes de trabajo. Esta vulnerabilidad se corrige en la versi\u00f3n 17.2.0."}], "lastModified": "2026-03-13T19:01:28.530", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4FB19C4D-0273-43F6-9AF6-3D30795D43BB", "versionEndExcluding": "17.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}