CVE-2026-52785 is a critical SQL injection vulnerability (CWE-89) affecting OpenProject, an open-source project management software. The issue exists in the timestamps functionality of the baseline comparison feature, where user input is not properly neutralized before being used in SQL commands. This allows an attacker with low privileges to execute arbitrary SQL queries, potentially leading to complete compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is resolved in OpenProject versions 17.3.3 and 17.4.1.

Successful exploitation can lead to full compromise of the affected OpenProject instance, including unauthorized data disclosure, data modification, and partial denial of service. The CVSS 3.1 base score is 9.9 (critical), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and complete impact on confidentiality, integrity, and partial impact on availability.

Upgrade OpenProject to version 17.3.3 or 17.4.1 or later, where this SQL injection vulnerability has been fixed. No other mitigation or temporary workaround is documented. Patch status is not explicitly stated but the description confirms the vulnerability is fixed in these versions.