CVE-2026-30239
Received Received - Intake
Improper Authorization in OpenProject Allows Unauthorized Budget Deletions

Publication date: 2026-03-11

Last updated on: 2026-03-13

Assigner: GitHub, Inc.

Description
OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when budgets are deleted, the work packages that were assigned to this budget need to be moved to a different budget. This action was performed before the permission check on the delete action was executed. This allowed all users in the application to delete work package budget assignments. This vulnerability is fixed in 17.2.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-11
Last Modified
2026-03-13
Generated
2026-06-16
AI Q&A
2026-03-11
EPSS Evaluated
2026-06-14
NVD
CVE-2026-30239
EUVD
EUVD-2026-11237
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
openproject openproject to 17.2.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-30239 is a moderate severity vulnerability in OpenProject versions prior to 17.2.0. It occurs during the deletion of budgets, where work packages assigned to the deleted budget must be reassigned to other budgets. The permission check for deleting budgets was performed after this reassignment action, which allowed any user with access to the application to bypass permission controls and delete work package budget assignments without proper authorization.

Impact Analysis

This vulnerability impacts data integrity by allowing unauthorized users to modify work package budget assignments. Specifically, users with low privileges can delete work package budget assignments without proper authorization. The vulnerability does not affect confidentiality or availability but can lead to unauthorized changes in project budget data.

Compliance Impact

I don't know

Detection Guidance

This vulnerability affects OpenProject versions prior to 17.2.0 and involves unauthorized deletion of work package budget assignments by bypassing permission checks.

To detect if your system is vulnerable, first verify the OpenProject version running on your system. If it is earlier than 17.2.0, it is potentially vulnerable.

You can check the OpenProject version by running the following command on the server hosting OpenProject:

  • `openproject version`

Additionally, monitor application logs for unauthorized deletion of budgets or work package budget assignments, especially actions performed by users with low privileges.

Since the vulnerability allows any authenticated user to delete work package budget assignments without proper authorization, reviewing audit logs for unexpected budget deletions can help detect exploitation attempts.

Mitigation Strategies

The primary mitigation step is to upgrade OpenProject to version 17.2.0 or later, where this vulnerability is fixed.

Until the upgrade can be performed, restrict access to the OpenProject application to trusted users only, minimizing the risk of unauthorized budget deletions.

Additionally, monitor and audit user actions related to budget deletions and work package assignments to detect and respond to any suspicious activity promptly.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-30239. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart