PT-2026-52903 · Unknown · Openproject
CVE-2026-44734
·
Published
2026-06-26
·
Updated
2026-06-27
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
OpenProject versions prior to 17.3.2
OpenProject versions prior to 17.4.0
Description
A missing authorization issue exists in the
CostReportsController. The rename and update actions allow any authenticated user to modify the name, filters, and grouping of any public cost report without verifying ownership or permission levels. An attacker who identifies a public report's numeric ID can rename it or overwrite its filter configuration without notifying the owner.Recommendations
Update to version 17.3.2.
Update to version 17.4.0.
Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Openproject