CVE-2026-24776 OpenProject has an IDOR on MeetingAgendaItems allows cross-project meeting agenda item transfer
An attacker can move meeting agenda items to other meetings via drag-and-drop, causing data confusion without needing access to the target meetings.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-24776?
CVE-2026-24776 is a medium-severity missing authorization vulnerability in opf openproject, published on 6 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenProject is an open-source, web-based project management software. Prior to 17.0.2, the drag&drop handler moving an agenda item to a different section was not properly checking if the target meeting section is part of the same meeting (or is the backlog, in case of recurring meetings). This allowed an attacker to move a meeting agenda item into a different meeting. The attacker did not get access to meetings, but they could add arbitrary agenda items, that could cause confusions. The vulnerability is fixed in 17.0.2.
Weakness: CWE-639
Which versions are affected by CVE-2026-24776?
It affects 1 product.
Products include Openproject Openproject.
How do I fix CVE-2026-24776?
No fix has been published for CVE-2026-24776 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-24776 being exploited?
There is no known exploitation of CVE-2026-24776 in the wild and no public exploit code.
Other vulnerabilities in opf openproject
- CVE-2026-34717 OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string
- CVE-2026-25763 Command Injection on OpenProject repositories leads to Remote Code Execution
- CVE-2026-24685 OpenProject has Argument Injection on Repository module that allows Arbitrary File Write
- CVE-2026-32698 OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution
- CVE-2026-32703 OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policy
Sources
Also known as GHSA-p9v8-w9ph-hqmf.