Cross-Site Request Forgery in OpenProject Web-Based Project Management Software

CVE-2026-24775

What is CVE-2026-24775?

OpenProject, a prominent open-source project management tool, introduced a serious security flaw in its collaborative document editing feature within version 17.0.0. The BlockNote editor's custom extension failed to validate work package IDs, allowing potential attackers to exploit this vulnerability. By creating a document with specific relative links, an attacker could potentially trigger arbitrary GET requests to any URL within the OpenProject instance, compromising sensitive data. This security issue has been addressed in version 0.0.22 of the op-blocknote-extensions included in OpenProject version 17.0.2. For users unable to immediately upgrade, disabling collaborative editing in the settings is advised to mitigate risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References