CVE-2026-40896: Openproject

High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days.

OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with `manage_agendas` permission in any project can inject agenda items into meetings belonging to any other project on the instance — even projects they have no access to. No knowledge of the target project, meeting, or victim is required; the attacker can blindly spray items into every meeting on the instance by iterating sequential section IDs. Version 17.3.0 patches the issue.

Affected products

• Openproject Openproject: before 17.3.0 (fixed in 17.3.0)

Published 2026-04-20. Last modified 2026-06-17.