Insufficient Validation in OpenProject Allows Unauthorized Agenda Modification
CVE-2026-24776

4.3MEDIUM

Key Information:

Vendor

Opf

Status
Openproject
Vendor
CVE Published:
6 February 2026

What is CVE-2026-24776?

OpenProject, an open-source web-based project management software, contained a vulnerability that allowed users to manipulate meeting agenda items by improperly validating the target meeting section. Before version 17.0.2, the drag&drop functionality did not ensure that agenda items were moved within the same meeting, or to a designated backlog for recurring meetings. This gap enabled an antagonist to introduce arbitrary agenda items into different meetings, leading to potential confusion and disorganization. The issue has been resolved in version 17.0.2, enhancing the software's security.

Affected Version(s)

openproject < 17.0.2

References

https://github.com/opf/openproject/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/opf/openproject/releases/tag/v17.0.2
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.