CVE-2026-52779: CWE-639: Authorization Bypass Through User-Controlled Key in opf openproject
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, a cross-project IDOR / authorization context confusion in the Calendar and Team Planner modules allows a user with management permissions in one project to delete public Calendar or Team Planner Queries from another project where they do not have the corresponding management permissions. Both modules authorize the request against the project identified by :project_id in the URL, but the actual Query object is loaded later by :id from Query.visible(current_user) without verifying that the loaded Query belongs to the authorized project. As a result, an attacker can use permissions from Project A to delete shared/public Calendar or Team Planner views from Project B, causing integrity impact and limited availability impact for users relying on those shared views. This vulnerability is fixed in 17.3.3 and 17.4.1.
AI Analysis
Technical Summary
CVE-2026-52779 is an authorization bypass vulnerability in OpenProject's Calendar and Team Planner modules affecting versions before 17.3.3 and 17.4.1. The vulnerability occurs due to a mismatch in authorization checks: the system authorizes actions against the project identified by :project_id in the URL, but subsequently loads the Query object by :id from Query.visible(current_user) without verifying that the Query belongs to the authorized project. This allows a user with management permissions in one project to delete public queries from another project where they lack such permissions, causing integrity and limited availability impacts. The vulnerability is addressed in OpenProject versions 17.3.3 and 17.4.1.
Potential Impact
An attacker with management permissions in one project can delete shared public Calendar or Team Planner queries from other projects where they do not have management permissions. This results in integrity impact by unauthorized deletion of shared views and limited availability impact for users depending on those views. There is no confidentiality impact reported. The CVSS v3.1 score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact.
Mitigation Recommendations
This vulnerability is fixed in OpenProject versions 17.3.3 and 17.4.1. Users should upgrade to at least these versions to remediate the issue. There is no vendor advisory indicating alternative mitigations or that no action is required. Patch status is confirmed by the version fix information in the description.
CVE-2026-52779: CWE-639: Authorization Bypass Through User-Controlled Key in opf openproject
Description
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, a cross-project IDOR / authorization context confusion in the Calendar and Team Planner modules allows a user with management permissions in one project to delete public Calendar or Team Planner Queries from another project where they do not have the corresponding management permissions. Both modules authorize the request against the project identified by :project_id in the URL, but the actual Query object is loaded later by :id from Query.visible(current_user) without verifying that the loaded Query belongs to the authorized project. As a result, an attacker can use permissions from Project A to delete shared/public Calendar or Team Planner views from Project B, causing integrity impact and limited availability impact for users relying on those shared views. This vulnerability is fixed in 17.3.3 and 17.4.1.
CVSS v3.1
Score 5.4medium
Affected software
pkg:github/opf/openprojectRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-52779 is an authorization bypass vulnerability in OpenProject's Calendar and Team Planner modules affecting versions before 17.3.3 and 17.4.1. The vulnerability occurs due to a mismatch in authorization checks: the system authorizes actions against the project identified by :project_id in the URL, but subsequently loads the Query object by :id from Query.visible(current_user) without verifying that the Query belongs to the authorized project. This allows a user with management permissions in one project to delete public queries from another project where they lack such permissions, causing integrity and limited availability impacts. The vulnerability is addressed in OpenProject versions 17.3.3 and 17.4.1.
Potential Impact
An attacker with management permissions in one project can delete shared public Calendar or Team Planner queries from other projects where they do not have management permissions. This results in integrity impact by unauthorized deletion of shared views and limited availability impact for users depending on those views. There is no confidentiality impact reported. The CVSS v3.1 score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact.
Mitigation Recommendations
This vulnerability is fixed in OpenProject versions 17.3.3 and 17.4.1. Users should upgrade to at least these versions to remediate the issue. There is no vendor advisory indicating alternative mitigations or that no action is required. Patch status is confirmed by the version fix information in the description.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-08T17:13:43.065Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3ed4eb72d29f1837ec3420
Added to database: 06/26/2026, 19:37:15 UTC
Last enriched: 06/26/2026, 19:52:49 UTC
Last updated: 06/26/2026, 21:08:06 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.