CVE-2026-24775

OpenProject is an open-source, web-based project management software. In the new editor for collaborative documents based on BlockNote, OpenProject maintainers added a custom extension in OpenProject version 17.0.0 that allows to mention OpenProject work packages in the document. To show work package details, the editor loads details about the work package via the OpenProject API. For this API call, the extension to the BlockNote editor did not properly validate the given work package ID to be only a number. This allowed an attacker to generate a document with relative links that upon opening could make arbitrary `GET` requests to any URL within the OpenProject instance. This issue was patched in version version 0.0.22 of op-blocknote-extensions, which was shipped with OpenProject 17.0.2. If users cannot update immediately to version 17.0.2 of OpenProject, administrators can disable collaborative document editing in Settings -> Documents -> Real time collaboration -> Disable.

• CWE-345

• https://github.com/opf/op-blocknote-extensions/releases/tag/v0.0.22Release Notes
• https://github.com/opf/openproject/security/advisories/GHSA-35c6-x276-2pvcPatch, Vendor Advisory

Published

Jan 28, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24769NocoDB is software for building databases as spreadsheets. P…9
• CVE-2026-24770RAGFlow is an open-source RAG (Retrieval-Augmented Generatio…9.8
• CVE-2026-24771Hono is a Web application framework that provides support fo…4.7
• CVE-2026-24772OpenProject is an open-source, web-based project management …9
• CVE-2026-24773The Open eClass platform (formerly known as GUnet eClass) is…7.5
• CVE-2026-24774The Open eClass platform (formerly known as GUnet eClass) is…4.3
• CVE-2026-24776OpenProject is an open-source, web-based project management …4.3
• CVE-2026-24777OpenProject is an open-source, web-based project management …6.7
• CVE-2026-24778Ghost is an open source content management system. In Ghost …6.1
• CVE-2026-24779vLLM is an inference and serving engine for large language m…7.1
• CVE-2026-24780AutoGPT is a platform that allows users to create, deploy, a…8.8
• CVE-2026-24781vm2 is an open source vm/sandbox for Node.js. Prior to versi…9.8