Authorization Confusion in OpenProject Calendar and Team Planner

CVE-2026-52779

What is CVE-2026-52779?

OpenProject, a widely-used open-source project management software, has a vulnerability that arises from an authorization context confusion in its Calendar and Team Planner modules. Users with management permissions in one project can exploit this issue to delete public Calendar or Team Planner Queries from another project without having the necessary management permissions. This occurs because the application does not properly verify that the queried object belongs to the authorized project, allowing unauthorized modifications. Users relying on shared views could face integrity issues and limited access, undermining the application's reliability for collaborative work. The flaw has been addressed in later versions 17.3.3 and 17.4.1, ensuring more secure project management operations.

References