Medium severity6.5NVD Advisory· Published Mar 11, 2026· Updated Jun 17, 2026
CVE-2026-30239
CVE-2026-30239
Description
OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when budgets are deleted, the work packages that were assigned to this budget need to be moved to a different budget. This action was performed before the permission check on the delete action was executed. This allowed all users in the application to delete work package budget assignments. This vulnerability is fixed in 17.2.0.
Affected products
3cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*range: <17.2.0
- (no CPE)range: <17.2.0
- (no CPE)range: < 17.2.0
Patches
Vulnerability mechanics
References
1- github.com/opf/openproject/security/advisories/GHSA-gpvh-g967-g4h8nvdVendor Advisory
News mentions
0No linked articles in our index yet.