OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with `manage_agendas` permission in any project can inject agenda items into meetings belonging to any other project on the instance — even projects they have no access to. No knowledge of the target project, meeting, or victim is required; the attacker can blindly spray items into every meeting on the instance by iterating sequential section IDs. Version 17.3.0 patches the issue.
References
| Link | Resource |
|---|---|
| https://github.com/opf/openproject/commit/8f693a1f35d0a84bb69af78fb6925f74329ae4fe | Patch |
| https://github.com/opf/openproject/security/advisories/GHSA-hh5p-gwf8-h245 | Exploit Mitigation Vendor Advisory |
| https://github.com/opf/openproject/security/advisories/GHSA-hh5p-gwf8-h245 | Exploit Mitigation Vendor Advisory |
Configurations
History
23 Apr 2026, 13:45
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/opf/openproject/commit/8f693a1f35d0a84bb69af78fb6925f74329ae4fe - Patch | |
| References | () https://github.com/opf/openproject/security/advisories/GHSA-hh5p-gwf8-h245 - Exploit, Mitigation, Vendor Advisory | |
| First Time |
Openproject openproject
Openproject |
|
| CPE | cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:* |
20 Apr 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/opf/openproject/security/advisories/GHSA-hh5p-gwf8-h245 - |
20 Apr 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-20 16:16
Updated : 2026-04-23 13:45
NVD link : CVE-2026-40896
Mitre link : CVE-2026-40896
CVE.ORG link : CVE-2026-40896
JSON object : View
Products Affected
openproject
- openproject