CVE-2026-52779: OpenProject Cross-Project IDOR in Calendar & Team Planner (CVSS 5.4)

Technical summary

The vulnerability is a cross-project Insecure Direct Object Reference (IDOR) combined with authorization context confusion in OpenProject's Calendar and Team Planner modules. The affected code path authorizes deletion requests based on the :project_id URL parameter, verifying the user has management permissions in that project. However, the actual Query object is retrieved independently via :id using Query.visible(current_user), which returns any query the user can theoretically see—without enforcing that it belongs to the authorized project. This temporal mismatch between authorization check and resource loading allows an authenticated user with management privileges in Project A to craft a request that deletes a public or shared query from Project B. The CWEs involved are CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-863 (Incorrect Authorization).

Business impact

Deletion of shared Calendar and Team Planner views disrupts team coordination and planning visibility. Project teams lose access to customized views they depend on for scheduling and resource allocation, reducing operational efficiency. The impact is primarily integrity-driven (unauthorized modification/deletion of shared data) with secondary availability concerns for dependent workflows. In organizations using OpenProject for critical project tracking, this could cause short-term schedule visibility loss until views are recreated. The risk is amplified in multi-project environments where teams frequently collaborate across boundaries.

Affected systems

OpenProject versions prior to 17.3.3 and 17.4.1 are vulnerable. The Calendar and Team Planner modules are the attack surface. The vulnerability requires the attacker to hold management permissions in at least one project and targets public or shared queries visible to them across project boundaries. Self-hosted and cloud-hosted OpenProject instances are equally affected.

Exploitability

Exploitability is straightforward for an authenticated user already granted project management permissions. No user interaction, unusual network conditions, or complex attack chains are required—a single HTTP request with a manipulated query ID can trigger the deletion. The attack requires only knowledge of a shared query's ID in another project, which can often be enumerated or observed through the UI. The low complexity and lack of authentication barriers make this readily exploitable within multi-project OpenProject deployments.

Remediation

Upgrade OpenProject to version 17.3.3 or 17.4.1, which implement proper authorization checks ensuring that the loaded Query belongs to the project context specified in the authorization check. Verify against the vendor's advisory that the patch correctly validates query ownership before permitting deletion. For environments unable to patch immediately, restrict management role assignments to prevent users with elevated privileges in one project from accessing unrelated projects, and review access control lists for Calendar and Team Planner queries across projects.

Patch guidance

Apply OpenProject 17.3.3 (for the 17.3.x branch) or 17.4.1 (for the 17.4.x branch) as applicable to your deployment. Verify the patch release notes confirm the fix for cross-project IDOR in Calendar and Team Planner modules. Test in a staging environment to ensure no regression in query visibility or deletion workflows before deploying to production. Organizations on earlier versions should prioritize this update given the low barrier to exploitation.

Detection guidance

Monitor OpenProject logs for DELETE or POST requests to query endpoints (typically /queries/:id or similar) where the :project_id in the URL differs from the project ID associated with the query being deleted. Look for patterns where a user with management permissions in one project repeatedly attempts to delete queries from projects where they lack such permissions. Enable audit logging if available to track query deletions and correlate them with user roles and project membership. Network-level detection is limited since the attack uses legitimate authenticated traffic; focus on application-level anomalies.

Why prioritize this

Although the CVSS score is 5.4 (Medium), this vulnerability warrants prompt remediation in multi-project environments. The low attack complexity, minimal authentication barriers, and direct disruption of team workflows make it attractive to insider threats or compromised accounts with limited privileges. The integrity and availability impact, while not severe in isolation, accumulates in collaborative settings. Organizations heavily reliant on OpenProject for project tracking should prioritize this patch ahead of lower-impact items.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects a Network-accessible attack requiring low privileges and low complexity, with no confidentiality impact but integrity and availability impacts rated as Low. The score appropriately captures the bounded scope—the attacker affects only the targeted project's views, not the broader system—and the requirement for prior authentication. However, business context elevates urgency: in mission-critical project management deployments, even Low-rated integrity/availability losses can cascade into scheduling delays.

Frequently asked questions