CVE-2026-30236

OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when editing a project budget and planning the labor cost, it was not checked that the user that was planned in the budget is actually a project member. This exposed the user's default rate (if one was set up) to users that should only see that information for project members. Also, the endpoint that handles the pre-calculation for the frontend to display a preview of the costs, while it was being entered, did not properly validate the membership of the user as well. This also allowed to calculate costs with the default rate of non-members. This vulnerability is fixed in 17.2.0.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/opf/openproject/security/advisories/GHSA-p747-569x-3v3f	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-11 17:16

Updated : 2026-03-13 19:02

NVD link : CVE-2026-30236

Mitre link : CVE-2026-30236

CVE.ORG link : CVE-2026-30236

JSON object : View

Products Affected

openproject

openproject

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-30236", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2026-03-11T17:16:57.623", "references": [{"url": "https://github.com/opf/openproject/security/advisories/GHSA-p747-569x-3v3f", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when editing a project budget and planning the labor cost, it was not checked that the user that was planned in the budget is actually a project member. This exposed the user's default rate (if one was set up) to users that should only see that information for project members. Also, the endpoint that handles the pre-calculation for the frontend to display a preview of the costs, while it was being entered, did not properly validate the membership of the user as well. This also allowed to calculate costs with the default rate of non-members. This vulnerability is fixed in 17.2.0."}, {"lang": "es", "value": "OpenProject es un software de gesti\u00f3n de proyectos de c\u00f3digo abierto y basado en la web. Antes de la 17.2.0, al editar un presupuesto de proyecto y planificar el costo de la mano de obra, no se verificaba que el usuario planificado en el presupuesto fuera realmente un miembro del proyecto. Esto expon\u00eda la tarifa predeterminada del usuario (si se hab\u00eda configurado una) a usuarios que solo deber\u00edan ver esa informaci\u00f3n para miembros del proyecto. Adem\u00e1s, el endpoint que maneja el prec\u00e1lculo para que el frontend muestre una vista previa de los costos, mientras se introduc\u00edan, tampoco validaba correctamente la membres\u00eda del usuario. Esto tambi\u00e9n permit\u00eda calcular costos con la tarifa predeterminada de no miembros. Esta vulnerabilidad est\u00e1 corregida en la 17.2.0."}], "lastModified": "2026-03-13T19:02:34.213", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4FB19C4D-0273-43F6-9AF6-3D30795D43BB", "versionEndExcluding": "17.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}