CVE-2026-40896 OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup
An attacker with agenda management rights in one project can inject items into meetings in other projects they cannot access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-40896?
CVE-2026-40896 is a medium-severity missing authorization vulnerability in opf openproject, published on 20 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with `manage_agendas` permission in any project can inject agenda items into meetings belonging to any other project on the instance — even projects they have no access to. No knowledge of the target project, meeting, or victim is required; the attacker can blindly spray items into every meeting on the instance by iterating sequential section IDs. Version 17.3.0 patches the issue.
Which versions are affected by CVE-2026-40896?
It affects 1 product.
Products include Openproject Openproject.
How do I fix CVE-2026-40896?
No fix has been published for CVE-2026-40896 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-40896 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40896 exists.
Other vulnerabilities in opf openproject
- CVE-2026-34717 OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string
- CVE-2026-25763 Command Injection on OpenProject repositories leads to Remote Code Execution
- CVE-2026-24685 OpenProject has Argument Injection on Repository module that allows Arbitrary File Write
- CVE-2026-32698 OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution
- CVE-2026-32703 OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policy
Sources
Also known as GHSA-hh5p-gwf8-h245.