CVE-2026-32698 is a critical SQL injection vulnerability identified in OpenProject, a widely used open-source web-based project management tool. The vulnerability exists in versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1. It stems from improper neutralization of special elements in SQL commands (CWE-89), specifically through a custom field's name that is incorporated into SQL queries for Cost Reports without adequate sanitization. Since custom fields can only be created by users with full administrator privileges, the initial attack vector is limited to high-privilege users. However, once exploited, the attacker can execute arbitrary SQL commands, potentially manipulating the database and application behavior. This SQL injection can be chained with a second vulnerability in the Repositories module, where the project identifier is used unsafely to generate git repository checkout paths on the server filesystem. By exploiting the SQL injection to alter the project identifier, an attacker can cause the application to checkout a git repository to an arbitrary path. If this path is within certain application directories, the attacker can inject malicious Ruby code that executes upon the next application restart, effectively achieving remote code execution. The vulnerability is severe due to its ability to compromise confidentiality, integrity, and availability of the system, and it requires no user interaction but does require administrator privileges. The CVSS v3.1 score is 9.1 (critical), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. The vulnerability has been fixed in versions 16.6.9, 17.0.6, 17.1.3, and 17.2.1. No known exploits have been reported in the wild as of the publication date.

The impact of CVE-2026-32698 is significant for organizations using vulnerable versions of OpenProject. An attacker with administrator privileges can exploit the SQL injection to execute arbitrary SQL commands, potentially leading to unauthorized data access, data manipulation, or deletion. The chained exploitation with the Repositories module vulnerability allows remote code execution by injecting malicious Ruby code, which can compromise the entire application and underlying server. This can result in full system compromise, data breaches, disruption of project management operations, and potential lateral movement within the network. Given OpenProject's use in managing critical projects and sensitive data, the compromise could affect business continuity, intellectual property confidentiality, and compliance with data protection regulations. The requirement for administrator privileges reduces the attack surface but does not eliminate risk, especially in environments with multiple administrators or where credentials may be compromised. The vulnerability's critical severity and potential for remote code execution make it a high-risk threat that demands immediate attention.

To mitigate CVE-2026-32698, organizations should immediately upgrade OpenProject to versions 16.6.9, 17.0.6, 17.1.3, or 17.2.1 or later, where the vulnerability is patched. Restrict administrator privileges strictly and audit existing administrator accounts to ensure only trusted personnel have such access. Implement strong authentication mechanisms, such as multi-factor authentication, to protect administrator accounts from compromise. Regularly review and sanitize all user inputs, especially custom fields and project identifiers, to prevent injection attacks. Monitor application logs for unusual SQL queries or repository checkout activities that may indicate exploitation attempts. Consider isolating the OpenProject server and limiting its network exposure to reduce the risk of remote exploitation. Additionally, conduct regular security assessments and penetration testing focused on injection vulnerabilities and code injection risks. Backup critical data and application configurations to enable recovery in case of compromise. Finally, stay informed about updates and advisories from the OpenProject community and security researchers.