CVE-2026-52779: CWE-639: Authorization Bypass Through User-Controlled Key in opf openproject
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, a cross-project IDOR / authorization context confusion in the Calendar and Team Planner modules allows a user with management permissions in one project to delete public Calendar or Team Planner Queries from another project where they do not have the corresponding management permissions. Both modules authorize the request against the project identified by :project_id in the URL, but the actual Query object is loaded later by :id from Query.visible(current_user) without verifying that the loaded Query belongs to the authorized project. As a result, an attacker can use permissions from Project A to delete shared/public Calendar or Team Planner views from Project B, causing integrity impact and limited availability impact for users relying on those shared views. This vulnerability is fixed in 17.3.3 and 17.4.1.
AI Analysis
Technical Summary
CVE-2026-52779 is an authorization bypass vulnerability in OpenProject's Calendar and Team Planner modules affecting versions prior to 17.3.3 and 17.4.1. The vulnerability occurs due to a mismatch in authorization checks: the request is authorized against the project identified by :project_id in the URL, but the actual Query object is loaded later by :id from Query.visible(current_user) without verifying that the Query belongs to the authorized project. This allows a user with management permissions in one project to delete public shared views (Calendar or Team Planner Queries) from another project where they lack management permissions. The impact includes integrity loss and limited availability for users depending on those shared views. The issue is resolved in OpenProject versions 17.3.3 and 17.4.1.
Potential Impact
An attacker with management permissions in one project can delete public Calendar or Team Planner Queries from other projects where they do not have permissions. This results in integrity impact by unauthorized deletion of shared views and limited availability impact for users relying on those views. There is no confidentiality impact reported. The CVSS v3.1 score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact.
Mitigation Recommendations
This vulnerability is fixed in OpenProject versions 17.3.3 and 17.4.1. Users should upgrade to at least these versions to remediate the issue. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor advisory stating the fix in these versions.
CVE-2026-52779: CWE-639: Authorization Bypass Through User-Controlled Key in opf openproject
Description
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, a cross-project IDOR / authorization context confusion in the Calendar and Team Planner modules allows a user with management permissions in one project to delete public Calendar or Team Planner Queries from another project where they do not have the corresponding management permissions. Both modules authorize the request against the project identified by :project_id in the URL, but the actual Query object is loaded later by :id from Query.visible(current_user) without verifying that the loaded Query belongs to the authorized project. As a result, an attacker can use permissions from Project A to delete shared/public Calendar or Team Planner views from Project B, causing integrity impact and limited availability impact for users relying on those shared views. This vulnerability is fixed in 17.3.3 and 17.4.1.
CVSS v3.1
Score 5.4medium
Affected software
pkg:github/opf/openprojectRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-52779 is an authorization bypass vulnerability in OpenProject's Calendar and Team Planner modules affecting versions prior to 17.3.3 and 17.4.1. The vulnerability occurs due to a mismatch in authorization checks: the request is authorized against the project identified by :project_id in the URL, but the actual Query object is loaded later by :id from Query.visible(current_user) without verifying that the Query belongs to the authorized project. This allows a user with management permissions in one project to delete public shared views (Calendar or Team Planner Queries) from another project where they lack management permissions. The impact includes integrity loss and limited availability for users depending on those shared views. The issue is resolved in OpenProject versions 17.3.3 and 17.4.1.
Potential Impact
An attacker with management permissions in one project can delete public Calendar or Team Planner Queries from other projects where they do not have permissions. This results in integrity impact by unauthorized deletion of shared views and limited availability impact for users relying on those views. There is no confidentiality impact reported. The CVSS v3.1 score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact.
Mitigation Recommendations
This vulnerability is fixed in OpenProject versions 17.3.3 and 17.4.1. Users should upgrade to at least these versions to remediate the issue. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor advisory stating the fix in these versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-08T17:13:43.065Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3ed4eb72d29f1837ec3420
Added to database: 06/26/2026, 19:37:15 UTC
Last enriched: 07/03/2026, 22:24:06 UTC
Last updated: 08/10/2026, 12:41:11 UTC
Views: 75
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.