CVE-2026-30239
Improper Authorization in OpenProject Allows Unauthorized Budget Deletions
Publication date: 2026-03-11
Last updated on: 2026-03-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openproject | openproject | to 17.2.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-30239 is a moderate severity vulnerability in OpenProject versions prior to 17.2.0. It occurs during the deletion of budgets, where work packages assigned to the deleted budget must be reassigned to other budgets. The permission check for deleting budgets was performed after this reassignment action, which allowed any user with access to the application to bypass permission controls and delete work package budget assignments without proper authorization.
How can this vulnerability impact me? :
This vulnerability impacts data integrity by allowing unauthorized users to modify work package budget assignments. Specifically, users with low privileges can delete work package budget assignments without proper authorization. The vulnerability does not affect confidentiality or availability but can lead to unauthorized changes in project budget data.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability affects OpenProject versions prior to 17.2.0 and involves unauthorized deletion of work package budget assignments by bypassing permission checks.
To detect if your system is vulnerable, first verify the OpenProject version running on your system. If it is earlier than 17.2.0, it is potentially vulnerable.
You can check the OpenProject version by running the following command on the server hosting OpenProject:
- `openproject version`
Additionally, monitor application logs for unauthorized deletion of budgets or work package budget assignments, especially actions performed by users with low privileges.
Since the vulnerability allows any authenticated user to delete work package budget assignments without proper authorization, reviewing audit logs for unexpected budget deletions can help detect exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade OpenProject to version 17.2.0 or later, where this vulnerability is fixed.
Until the upgrade can be performed, restrict access to the OpenProject application to trusted users only, minimizing the risk of unauthorized budget deletions.
Additionally, monitor and audit user actions related to budget deletions and work package assignments to detect and respond to any suspicious activity promptly.