These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
Authenticated non-admin users could enumerate sequential custom option ids and read labels belonging to admin_only user or group custom fields in OpenProject prior to 17.6.0. This vulnerability allows potential enumeration and information disclosure, impacting OpenProject administrators and users with custom option configurations. It is recommended to verify the OpenProject version and apply the patch if [truncated]
The OpenProject application, prior to version 17.6.0, contains a vulnerability in the PATCH /api/v3/work_packages/{id} endpoint. This vulnerability allows authenticated users with edit_work_packages permissions but without manage_file_links permissions to manipulate FileLinks associated with work packages. Specifically, such users can resolve Storages::FileLink records by raw ID, detach or hard-delete exi [truncated]
CVE-2026-52783 is a high-severity vulnerability in OpenProject's Storages module. Prior to versions 17.3.3 and 17.4.1, the module writes OneDrive/SharePoint userless OAuth access tokens in plaintext to Rails.cache. The tokens are continuously repopulated by an hourly cron job and every userless-OAuth call site. Since none of the three allowed cache backends (file_store, memcache, redis) encrypts data at r [truncated]
CVE-2026-52781 is a medium-severity vulnerability in OpenProject, an open-source project management software. The issue lies in the HTML sanitizer, which grants <macro> elements unrestricted data-* attributes via :data wildcard. This allows an attacker to inject malicious attributes, such as data-controller='poll-for-changes', into a work package description. Consequently, Stimulus.js mounts a controller [truncated]
CVE-2026-44735 is a vulnerability in OpenProject, an open-source, web-based project management software. The issue arises from the GET /api/v3/shares endpoint, which returns share details for all work packages in a project to any user with the view_shared_work_packages permission. However, the authorization check only operates at the project level and does not verify if the requesting user can view each i [truncated]
CVE-2026-44733 is a medium-severity vulnerability in OpenProject, an open-source, web-based project management software. The vulnerability, classified as a business logic error, allows attackers to bypass password requirements through a PATCH request to /api/v3/users/me. This is possible due to a password validation flaw in the change password behavior, which can be exploited with an active session takeov [truncated]