CVE-2026-22605

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22605", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-07T21:50:39.533Z", "datePublished": "2026-01-10T01:07:10.412Z", "dateUpdated": "2026-01-12T19:15:27.143Z"}, "containers": {"cna": {"title": "OpenProject is Vulnerable to Insecure Direct Object Reference in Meetings", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/opf/openproject/security/advisories/GHSA-fq4m-pxvm-8x2j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/opf/openproject/security/advisories/GHSA-fq4m-pxvm-8x2j"}, {"name": "https://github.com/opf/openproject/releases/tag/v16.6.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/opf/openproject/releases/tag/v16.6.3"}], "affected": [{"vendor": "opf", "product": "openproject", "versions": [{"version": "< 16.6.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-10T01:07:10.412Z"}, "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. OpenProject versions prior to version 16.6.3, allowed users with the View Meetings permission on any project, to access meeting details of meetings that belonged to projects, the user does not have access to. This issue has been patched in version 16.6.3."}], "source": {"advisory": "GHSA-fq4m-pxvm-8x2j", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-12T19:15:19.921386Z", "id": "CVE-2026-22605", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-12T19:15:27.143Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22605", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-12T19:15:19.921386Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-12T19:15:24.629Z"}}], "cna": {"title": "OpenProject is Vulnerable to Insecure Direct Object Reference in Meetings", "source": {"advisory": "GHSA-fq4m-pxvm-8x2j", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "opf", "product": "openproject", "versions": [{"status": "affected", "version": "< 16.6.3"}]}], "references": [{"url": "https://github.com/opf/openproject/security/advisories/GHSA-fq4m-pxvm-8x2j", "name": "https://github.com/opf/openproject/security/advisories/GHSA-fq4m-pxvm-8x2j", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/opf/openproject/releases/tag/v16.6.3", "name": "https://github.com/opf/openproject/releases/tag/v16.6.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. OpenProject versions prior to version 16.6.3, allowed users with the View Meetings permission on any project, to access meeting details of meetings that belonged to projects, the user does not have access to. This issue has been patched in version 16.6.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-10T01:07:10.412Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22605", "state": "PUBLISHED", "dateUpdated": "2026-01-12T19:15:27.143Z", "dateReserved": "2026-01-07T21:50:39.533Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-10T01:07:10.412Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openproject", "vendor": "opf", "versions": [{"status": "affected", "version": "< 16.6.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*", "matchCriteriaId": "B2267B9E-E4A8-4C9D-9BEF-BE744BAEDF0E", "versionEndExcluding": "16.6.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. OpenProject versions prior to version 16.6.3, allowed users with the View Meetings permission on any project, to access meeting details of meetings that belonged to projects, the user does not have access to. This issue has been patched in version 16.6.3."}, {"lang": "es", "value": "OpenProject es un software de gesti\u00f3n de proyectos de c\u00f3digo abierto y basado en la web. Las versiones de OpenProject anteriores a la versi\u00f3n 16.6.3 permit\u00edan a los usuarios con el permiso 'Ver reuniones' en cualquier proyecto, acceder a los detalles de reuniones que pertenec\u00edan a proyectos a los que el usuario no ten\u00eda acceso. Este problema ha sido parcheado en la versi\u00f3n 16.6.3."}], "id": "CVE-2026-22605", "lastModified": "2026-06-17T10:20:09.000", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22605", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-12T19:15:19.921386Z", "version": "2.0.3"}}]}, "published": "2026-01-10T02:15:49.487", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/opf/openproject/releases/tag/v16.6.3"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/opf/openproject/security/advisories/GHSA-fq4m-pxvm-8x2j"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T07:16:48.675441+00:00", "value": {"mitigation_remediation": ["Update OpenProject to version 16.6.3 or later, which contains a fix for the IDA.", "Revoke or restrict the View Meetings permission for users who should not be able to access meetings in projects where they have no other privileges.", "Conduct an audit of existing permission assignments in OpenProject to enforce the principle of least privilege across all projects."], "summary": {"action": "Patch", "impact": "Insecure Direct Object Reference exposing meeting details"}, "threat_synthesis": {"affected_systems": "The affected products are OpenProject itself. All installations running OpenProject before version 16.6.3 are susceptible, regardless of minor patch levels. Users of the open\u2011source project management application should check their installed version and apply the recommended upgrade if they are on any earlier release.", "description_and_impact": "OpenProject versions before 16.6.3 allow any user who has the View Meetings permission in a project to view the details of meetings belonging to projects that the user does not have access to. The vulnerability is an Insecure Direct Object Reference (CWE\u2011284), which permits unauthorized disclosure of meeting information.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a moderate risk level. The EPSS score of <1% shows a low likelihood that the vulnerability is being actively exploited, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated account that possesses the View Meetings privilege; once accessed, the attacker can retrieve meeting metadata and potentially sensitive content belonging to other projects."}}}}, "created": "2026-01-12T14:36:50.516415+00:00", "updated": "2026-04-18T07:30:36.019938+00:00", "vendors": ["openproject", "openproject$PRODUCT$openproject"]}