Executive Summary

CVE-2026-44734 is an Improper Access Control vulnerability in the OpenProject software, specifically in the CostReportsController component. It affects versions prior to 17.3.2 and 17.4.0.

The issue allows any authenticated user to rename or update any public cost report's name, filters, and grouping without verifying if the user owns the report or has the appropriate permission level.

An attacker can exploit this vulnerability by discovering or guessing the numeric ID of a public report and then modifying it without the report owner's knowledge.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade OpenProject to version 17.3.2 or later, or 17.4.0 or later, where the issue has been fixed.

This will ensure that the CostReportsController properly verifies ownership and permission levels before allowing modifications to public cost reports.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthorized authenticated users to modify public cost reports in your OpenProject system.

• Attackers can rename reports, potentially causing confusion or misrepresentation of data.
• They can also overwrite filter configurations, which may alter how data is grouped or displayed, leading to incorrect or misleading project cost information.

These unauthorized changes occur without any warning to the report owner, which can undermine trust and data integrity within your project management environment.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows any authenticated user to modify public cost reports without verifying ownership or permission level, potentially leading to unauthorized changes in data presentation or filtering.

However, there is no direct information provided about how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0