CVE-2026-27723: OpenProject: Insufficient access control leads to create Wiki objects belongs unpermitted projects

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-05 · updated 2026-06-17
Weakness: CWE-284

Description

OpenProject is an open-source, web-based project management software. Prior to versions 17.0.5 and 17.1.2, an attacker can create wiki pages belonging to unpermitted projects through an improperly authenticated request. This issue has been patched in versions 17.0.5 and 17.1.2.

Affected products

opf openproject: before 17.0.5; from 17.1.0 before 17.1.2 — fixed in 17.0.5, 17.1.2

How to fix

Upgrade to a fixed version: opf openproject 17.0.5, 17.1.2. Check the vendor advisory for mitigations.

References

https://github.com/opf/openproject/releases/tag/v17.0.5
https://github.com/opf/openproject/releases/tag/v17.1.2
https://github.com/opf/openproject/security/advisories/GHSA-9gc6-3xjq-pwc9

Get alerted when CVE-2026-27723 or the next vulnerability affects your stack