OpenProject has Improper Access Control on User Management allows user managers to lock admin accounts

OpenProject: Improper Access Control on OpenProject through the POST request to /projects/[PROJECT_NAME]/cost_reports/[REPORT_ID]/rename

OpenProject: Shares API Information Disclosure

OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects

Business Logic Error on OpenProject through hyperlinks in markdown using DOM clobbering

OpenProject BIM BCF XML Import: <Snapshot> Path Traversal Leads to Arbitrary Local File Read (AFR)

OpenProject users can delete other user's session, causing them to be logged out

OpenProject: Stored XSS on openproject.example.com through /api/v3/projects/{project}/work_packages via POST parameter "description"

OpenProject: Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass password requirements

OpenProject: Stored CSS injection via Sanitize::Config::RELAXED[:css] enables phishing overlays and data exfiltration

OpenProject: Cross-project authorization bypass allows deleting public Calendar and Team Planner queries from unauthorized projects

OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policy

OpenProject has stored XSS regression using attachments and script-src self

OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields

OpenProject: Insufficient access control leads to create Wiki objects belongs unpermitted projects

OpenProject: Private work package subject/identity disclosure through the global Time Entries and Cost Entries APIs (linked work package rendered without visibility check)

OpenProject: Improper Access Control through /api/v3/custom_options/:id via Path "id" leads to Sensitive Data Exposure

OpenProject: Improper Access Control on OpenProject through /projects/[projectName]/meetings via "invited_user_id" in GET parameter "filters" leads to user names disclosure

OpenProject: IDOR on OpenProject through /api/v3/documents/{id} via PATCH parameter "project_id" leads to Unauthorized Modification of Resources

OpenProject: Private work package data disclosure through single meeting agenda item API

Blind SSRF on OpenProject instance via webhooks

OpenProject users that are not project members can be used to calculate Labor Budget, leaking their global hourly rate

OpenProject has an IDOR on MeetingAgendaItems allows cross-project meeting agenda item transfer

OpenProject users with "View Members" permission in any project can view all Group memberships