Openproject · Openproject · CVE-2026-22605
**Name of the Vulnerable Software and Affected Versions**
OpenProject versions prior to 16.6.3
**Description**
OpenProject is a web-based project management software. Versions prior to 16.6.3 allowed users with the ‘View Meetings’ permission on any project to access meeting details from projects they did not have access to. This is due to an insecure direct object reference issue.
**Recommendations**
Update to version 16.6.3 or later.