CVE-2026-27723

Published: Mar 5, 2026Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

OpenProject is an open-source, web-based project management software. Prior to versions 17.0.5 and 17.1.2, an attacker can create wiki pages belonging to unpermitted projects through an improperly authenticated request. This issue has been patched in versions 17.0.5 and 17.1.2.

Affected (2)

Products: Openproject: Openproject

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Openproject Openproject	Before 17.0.5
Openproject Openproject	From 17.1.0 to 17.1.2

Related CWEs

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (3)

https://github.com/opf/openproject/releases/tag/v17.0.5

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/opf/openproject/releases/tag/v17.1.2

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/opf/openproject/security/advisories/GHSA-9gc6-3xjq-pwc9

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.