CVE-2026-44732— OpenProject: IDOR on OpenProject through /api/v3/documents/{id} via PATCH parameter "project_id" leads to Unauthorized Modification of Resources
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| opf | openproject | < 17.3.2 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-44732
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenProject: IDOR on OpenProject through /api/v3/documents/{id} via PATCH parameter "project_id" leads to Unauthorized Modification of Resources
Source: NVD (National Vulnerability Database)
Vulnerability Description
OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, OpenProject exposes a document update endpoint used to modify existing documents. The target document is loaded with visibility checks and then updated. During update, attacker-controlled attributes are applied to the persisted record before authorization is enforced. As a result, a user without :manage_documents in the source project can move and modify foreign project documents by setting project_id in a single PATCH request. This vulnerability is fixed in 17.3.2 and 17.4.0.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: NVD (National Vulnerability Database)
Vulnerability Title
OPF OpenProject 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
opf openproject是opf的项目管理软件。 OPF OpenProject 17.3.2之前版本存在授权问题漏洞，该漏洞源于文档更新端点授权检查不足，导致没有源项目管理文档权限的用户可通过单个PATCH请求设置project_id来移动和修改外部项目文档。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| opf | openproject | < 17.3.2 | - |
II. Public POCs for CVE-2026-44732
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-44732
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-44732 (1)
Same Patch Batch · opf · 2026-06-26 · 17 CVEs total
| CVE-2026-52782 | 9.9 CRITICAL | OpenProject: IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH para |
| CVE-2026-52785 | 9.9 CRITICAL | OpenProject: SQL injection in timestamps functionality |
| CVE-2026-46386 | 9.9 CRITICAL | OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `S |
| CVE-2026-52780 | 9.6 CRITICAL | OpenProject: Cache store poisoning leads to Remote Code Execution (RCE) |
| CVE-2026-52784 | 8.8 HIGH | OpenProject: CSRF on TARGET through /users/:id via POST parameter "user[admin]" |
| CVE-2026-52783 | 8.2 HIGH | OpenProject: Information Disclosure (cleartext storage of data) on localhost through memca |
| CVE-2026-47193 | 7.5 HIGH | OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks |
| CVE-2026-44734 | 6.5 MEDIUM | OpenProject: Improper Access Control on OpenProject through the POST request to /projects/ |
| CVE-2026-44736 | 6.5 MEDIUM | OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Pa |
| CVE-2026-44735 | 6.5 MEDIUM | OpenProject: Shares API Information Disclosure |
| CVE-2026-52781 | 6.4 MEDIUM | OpenProject: Stored XSS on openproject.example.com through /api/v3/projects/{project}/work |
| CVE-2026-44733 | 5.9 MEDIUM | OpenProject: Business Logic Error on OpenProject through PATCH request to /api/v3/users/me |
| CVE-2026-44696 | 5.7 MEDIUM | OpenProject: Stored CSS injection via Sanitize::Config::RELAXED[:css] enables phishing ove |
| CVE-2026-52779 | 5.4 MEDIUM | OpenProject: Cross-project authorization bypass allows deleting public Calendar and Team P |
| CVE-2026-49355 | 4.3 MEDIUM | OpenProject: Private work package data disclosure through single meeting agenda item API |
| CVE-2026-44731 | 4.3 MEDIUM | OpenProject: Improper Access Control on OpenProject through /projects/[projectName]/meetin |
IV. Related Vulnerabilities
Same product: openproject
- CVE-2026-44733
OpenProject: Business Logic Error on OpenProject through PAT - CVE-2026-44731
OpenProject: Improper Access Control on OpenProject through - CVE-2026-44734
OpenProject: Improper Access Control on OpenProject through - CVE-2026-44735
OpenProject: Shares API Information Disclosure - CVE-2026-44696
OpenProject: Stored CSS injection via Sanitize::Config::RELA
Same vendor: opf
- CVE-2026-44733
OpenProject: Business Logic Error on OpenProject through PAT - CVE-2026-44731
OpenProject: Improper Access Control on OpenProject through - CVE-2026-44734
OpenProject: Improper Access Control on OpenProject through - CVE-2026-44735
OpenProject: Shares API Information Disclosure - CVE-2026-44696
OpenProject: Stored CSS injection via Sanitize::Config::RELA
Same weakness: CWE-639
- CVE-2026-14753
mjperpinosa stumasy Note Handler/Assignment notes authorizat - CVE-2026-28740
Gitea LFS object reuse bypasses Code-unit authorization - CVE-2026-27657
Gitea email settings allow changing another user's primary e - CVE-2026-25782
Gitea tracked-time deletion can target entries from another - CVE-2026-14608
SourceCodester CET Automated Grading System with AI Predicti
V. Comments for CVE-2026-44732
No comments yet