CVE-2026-40896

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.3.0

Description A user with manage agendas permission in any project can inject agenda items into meetings belonging to any other project on the instance, including those they cannot access. This is possible by iterating sequential section IDs, allowing an attacker to blindly spray items into every meeting on the instance without needing prior knowledge of the target project, meeting, or victim.

Recommendations Update to version 17.3.0.