CVEvulnerability
CVE-2026-27723
5.3 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2026-03-05
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weaknesses
- CWE-284
Description
OpenProject is an open-source, web-based project management software. Prior to versions 17.0.5 and 17.1.2, an attacker can create wiki pages belonging to unpermitted projects through an improperly authenticated request. This issue has been patched in versions 17.0.5 and 17.1.2.
Affected configurations
• openproject openproject (< 17.0.5)
• openproject openproject (>= 17.1.0 < 17.1.2)
Related
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
References
- https://github.com/opf/openproject/releases/tag/v17.0.5 Product, Release Notes
- https://github.com/opf/openproject/releases/tag/v17.1.2 Product, Release Notes
- https://github.com/opf/openproject/security/advisories/GHSA-9gc6-3xjq-pwc9 Vendor Advisory