OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`

OpenProject: IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[project_folder_id]" leads to Access to Unauthorized Resources

OpenProject: SQL injection in timestamps functionality

Command Injection on OpenProject repositories leads to Remote Code Execution

OpenProject: Cache store poisoning leads to Remote Code Execution (RCE)

OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server

OpenProject: CSRF on TARGET through /users/:id via POST parameter "user[admin]"

OpenProject has Argument Injection on Repository module that allows Arbitrary File Write

OpenProject: Information Disclosure (cleartext storage of data) on localhost through memcached via Others "storage.<id>.httpx_access_token" leads to Sensitive Data Exposure

OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string

OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks"

OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks

OpenProject: 2FA OTP Verification Missing Rate Limiting

OpenProject has Forced Actions, Content Spoofing, and Persistent DoS via ID Manipulation in OpenProject Blocknote Editor Extension

OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution

OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup

OpenProject has a Permission Check bypass on Budget deletion allows reassignment of WorkPackages into other budgets

OpenProject has Improper Access Control on User Management allows user managers to lock admin accounts

OpenProject: Improper Access Control on OpenProject through the POST request to /projects/[PROJECT_NAME]/cost_reports/[REPORT_ID]/rename

OpenProject: Shares API Information Disclosure

OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects

Business Logic Error on OpenProject through hyperlinks in markdown using DOM clobbering

OpenProject BIM BCF XML Import: <Snapshot> Path Traversal Leads to Arbitrary Local File Read (AFR)

OpenProject: Stored XSS on openproject.example.com through /api/v3/projects/{project}/work_packages via POST parameter "description"

OpenProject: Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass password requirements

OpenProject: Stored CSS injection via Sanitize::Config::RELAXED[:css] enables phishing overlays and data exfiltration

OpenProject: Cross-project authorization bypass allows deleting public Calendar and Team Planner queries from unauthorized projects

OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policy

OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields

OpenProject: Insufficient access control leads to create Wiki objects belongs unpermitted projects

OpenProject: Private work package subject/identity disclosure through the global Time Entries and Cost Entries APIs (linked work package rendered without visibility check)

OpenProject: Improper Access Control through /api/v3/custom_options/:id via Path "id" leads to Sensitive Data Exposure

OpenProject: Improper Access Control on OpenProject through /projects/[projectName]/meetings via "invited_user_id" in GET parameter "filters" leads to user names disclosure

OpenProject: IDOR on OpenProject through /api/v3/documents/{id} via PATCH parameter "project_id" leads to Unauthorized Modification of Resources

OpenProject: Private work package data disclosure through single meeting agenda item API

Blind SSRF on OpenProject instance via webhooks

OpenProject users that are not project members can be used to calculate Labor Budget, leaking their global hourly rate

OpenProject has an IDOR on MeetingAgendaItems allows cross-project meeting agenda item transfer

OpenProject vulnerable to Stored HTML injection