Access Control Issue in OpenProject Affects User Meeting Permissions
CVE-2026-22605

4.3MEDIUM

Key Information:

Vendor

Opf

Status
Openproject
Vendor
CVE Published:
10 January 2026

What is CVE-2026-22605?

OpenProject, a widely used open-source project management software, had an access control flaw that permitted users with the 'View Meetings' permission to gain visibility into meeting details of projects they were not authorized to access. This vulnerability was present in all versions prior to 16.6.3. The issue has been addressed and patched in version 16.6.3, enhancing security measures to prevent unauthorized information exposure.

Affected Version(s)

openproject < 16.6.3

References

https://github.com/opf/openproject/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/opf/openproject/releases/tag/v16.6.3
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.