CVE-2026-30236

OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when editing a project budget and planning the labor cost, it was not checked that the user that was planned in the budget is actually a project member. This exposed the user's default rate (if one was set up) to users that should only see that information for project members. Also, the endpoint that handles the pre-calculation for the frontend to display a preview of the costs, while it was being entered, did not properly validate the membership of the user as well. This also allowed to calculate costs with the default rate of non-members. This vulnerability is fixed in 17.2.0.

• CWE-863

• https://github.com/opf/openproject/security/advisories/GHSA-p747-569x-3v3fVendor Advisory

Published

Mar 11, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30230Flare is a Next.js-based, self-hostable file sharing platfor…7.5
• CVE-2026-30231Flare is a Next.js-based, self-hostable file sharing platfor…5.3
• CVE-2026-30232Chartbrew is an open-source web application that can connect…9.6
• CVE-2026-30233OliveTin gives access to predefined shell commands from a we…4.3
• CVE-2026-30234OpenProject is an open-source, web-based project management …6.5
• CVE-2026-30235OpenProject is an open-source, web-based project management …6.5
• CVE-2026-30237Group-Office is an enterprise customer relationship manageme…6.1
• CVE-2026-30238Group-Office is an enterprise customer relationship manageme…6.1
• CVE-2026-30239OpenProject is an open-source, web-based project management …7.1
• CVE-2026-3024Stored Cross-Site Scripting (XSS) vulnerability in the Wakym…5.4
• CVE-2026-30240Budibase is a low code platform for creating internal tools,…8.1
• CVE-2026-30241Mercurius is a GraphQL adapter for Fastify. Prior to version…8.2