CVE-2026-44732

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.3.2 OpenProject versions prior to 17.4.0

Description OpenProject exposes a document update endpoint used to modify existing documents. The system loads the target document with visibility checks, but attacker-controlled attributes are applied to the persisted record before authorization is enforced. This allows a user lacking :manage documents permissions in the source project to move and modify documents from foreign projects by manipulating the project id variable in a PATCH request.

Recommendations Update to version 17.3.2. Update to version 17.4.0.