CVE-2026-30239OpenProject has a Permission Check bypass on Budget deletion allows reassignment of WorkPackages into other budgets
Updated under an hour ago ()
Does this affect you?
It affects opf openproject and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when budgets are deleted, the work packages that were assigned to this budget need to be moved to a different budget. This action was performed before the permission check on the delete action was executed. This allowed all users in the application to delete work package budget assignments. This vulnerability is fixed in 17.2.0.
- CVSS
- 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Weakness (CWE)
- CWE-863
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Analyzed
- Record last updated
- Mar 11, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
opf openproject opf:openproject (from the name) | before 17.2.0 | CNA record |
openproject openproject openproject:openproject | before 17.2.0 | NVD |
References
- https://github.com/opf/openproject/security/advisories/GHSA-gpvh-g967-g4h8x-refsource-confirm, vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.