Overview · opf/openproject · GitHub

Security

Report a vulnerability

SECURITY.md

Please find our statement on security in this document: https://www.openproject.org/docs/security-and-privacy/statement-on-security/

Users with "View Members" permission in any project can view all Group memberships
GHSA-vj77-wrc2-5h5h published Jan 19, 2026 by klaustopher

Moderate
Stored XSS regression on OpenProject using attachments and script-src self
GHSA-cvpq-cc56-gwxx published Jan 19, 2026 by klaustopher

High
Arbitrary File Read via ImageMagick SVG Coder
GHSA-m8f2-cwpq-vvhh published Jan 9, 2026 by oliverguenther

Critical
Missing permission check for deletion of Boards
GHSA-frrc-prg7-xq7h published Feb 16, 2026 by oliverguenther

Moderate
Users with read only permissions could modify order in boards and remove items from boards
GHSA-2mv7-3f2v-2fg9 published Feb 16, 2026 by oliverguenther

Moderate
Insecure Direct Object Reference in Meetings
GHSA-fq4m-pxvm-8x2j published Jan 9, 2026 by oliverguenther

Moderate
No protection against brute-force attacks in the Change Password function
GHSA-93x5-prx9-x239 published Jan 9, 2026 by oliverguenther

Moderate
User enumeration via the change password function
GHSA-q7qp-p3vw-j2fh published Jan 9, 2026 by oliverguenther

Moderate
User Enumeration via User ID
GHSA-7fvx-9h6h-g82j published Jan 9, 2026 by oliverguenther

Low
Code Execution in E-Mail function
GHSA-9vrv-7h26-c7jc published Jan 9, 2026 by oliverguenther

High

Learn more about advisories related to opf/openproject in the GitHub Advisory Database