CVE-2026-40896

Katalog CVE

CVSS 7.1 · High EPSS 0,24%

Kerentanan Time-of-check Time-of-use (TOCTOU) Race Condition pada openproject. Skor CVSS 3.1 7.1 (High) menurut NVD.

Deskripsi (NVD)

OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with `manage_agendas` permission in any project can inject agenda items into meetings belonging to any other project on the instance — even projects they have no access to. No knowledge of the target project, meeting, or victim is required; the attacker can blindly spray items into every meeting on the instance by iterating sequential section IDs. Version 17.3.0 patches the issue.

Rincian

Terbit di NVD

20 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 13,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/opf/openproject/security/advisories/GHSA-hh5p-gwf8-h245 exploit · mitigasi · advisory vendor
• https://github.com/opf/openproject/commit/8f693a1f35d0a84bb69af78fb6925f74329ae4fe patch