CVE-2026-52779

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.3.3 OpenProject versions prior to 17.4.1

Description An authorization context confusion and Insecure Direct Object Reference (IDOR) exist within the Calendar and Team Planner modules. A user with management permissions in one project can delete public Calendar or Team Planner Queries from a different project where they lack such permissions. The system authorizes the request based on the :project id in the URL, but subsequently loads the Query object using the :id variable from Query.visible(current user) without verifying if the loaded Query belongs to the authorized project. This allows an attacker to delete shared views in another project, impacting data integrity and availability.

Recommendations Update to version 17.3.3. Update to version 17.4.1.