CVE-2026-24775: OpenProject SSRF Vulnerability

CVE-2026-24775 Overview

CVE-2026-24775 is a Server-Side Request Forgery (SSRF) vulnerability discovered in OpenProject, an open-source, web-based project management software. The vulnerability exists in the custom BlockNote editor extension used for collaborative document editing. Due to insufficient validation of work package IDs, an attacker can craft malicious documents containing relative links that trigger unauthorized GET requests to arbitrary URLs within the OpenProject instance when the document is opened.

Critical Impact

Authenticated attackers can leverage improper input validation in the BlockNote editor to make arbitrary internal requests, potentially accessing sensitive data or internal services within the OpenProject infrastructure.

Affected Products

• OpenProject version 17.0.0
• OpenProject version 17.0.1
• op-blocknote-extensions versions prior to 0.0.22

Discovery Timeline

• 2026-01-28 - CVE CVE-2026-24775 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-24775

Vulnerability Analysis

This vulnerability stems from CWE-345 (Insufficient Verification of Data Authenticity) in OpenProject's collaborative document editing functionality. The BlockNote editor extension, introduced in OpenProject version 17.0.0, includes a feature allowing users to mention and reference work packages within documents. When a document containing a work package reference is opened, the editor makes API calls to retrieve and display work package details.

The critical flaw lies in the validation logic for work package IDs. The extension fails to properly validate that the supplied work package ID parameter consists solely of numeric characters. This insufficient validation allows an attacker to inject relative path components or arbitrary URL segments in place of legitimate work package identifiers.

When a victim opens a maliciously crafted document, the editor attempts to fetch "work package details" using the attacker-controlled path, effectively turning the OpenProject server into a proxy for making arbitrary GET requests to internal endpoints.

Root Cause

The root cause of this vulnerability is improper input validation in the op-blocknote-extensions package. The extension accepts work package reference parameters without enforcing strict numeric validation, allowing attackers to supply arbitrary path segments. This oversight enables the construction of relative URLs that bypass intended API endpoint restrictions, allowing requests to any internal URL accessible by the OpenProject instance.

Attack Vector

The attack is network-based and requires low privileges (authenticated user access) with user interaction (victim must open the malicious document). An attacker would:

1. Create a collaborative document with a specially crafted work package mention
2. Instead of a valid numeric work package ID, inject a relative path (e.g., ../../admin/settings)
3. Share the document with target users
4. When victims open the document, the editor makes GET requests to the attacker-specified internal URLs
5. Response data may be exposed to the attacker depending on how the editor processes the response

This SSRF vulnerability can potentially be used to access internal APIs, administrative endpoints, or other services accessible from the OpenProject server's network context.

Detection Methods for CVE-2026-24775

Indicators of Compromise

• Unusual API requests to the OpenProject work packages endpoint containing non-numeric characters or path traversal sequences
• Collaborative documents with suspicious work package reference syntax containing relative paths
• Server logs showing GET requests to unexpected internal endpoints originating from the document editor context
• Access attempts to administrative or restricted URLs from the BlockNote editor component

Detection Strategies

• Monitor HTTP request logs for work package API calls containing path traversal patterns like ../ or non-numeric characters
• Implement Web Application Firewall (WAF) rules to detect and block requests with path manipulation attempts in work package ID parameters
• Review collaborative documents for malformed work package references that don't conform to expected numeric format
• Set up alerting for unusual internal network traffic patterns originating from the OpenProject application server

Monitoring Recommendations

• Enable detailed logging for all API requests to the work package endpoints
• Implement anomaly detection for document-related API calls that deviate from expected patterns
• Monitor for elevated request rates to internal endpoints from document editing sessions
• Configure network monitoring to detect SSRF-like behavior where the application server makes requests to internal services

How to Mitigate CVE-2026-24775

Immediate Actions Required

• Upgrade OpenProject to version 17.0.2 or later immediately
• If immediate upgrade is not possible, disable collaborative document editing via Settings → Documents → Real time collaboration → Disable
• Review existing collaborative documents for suspicious content or malformed work package references
• Audit server logs for any evidence of exploitation attempts

Patch Information

The vulnerability has been patched in op-blocknote-extensions version 0.0.22, which is included in OpenProject version 17.0.2. The fix implements proper validation to ensure work package IDs are strictly numeric before making API requests. For more information, see the GitHub Security Advisory GHSA-35c6-x276-2pvc and the op-blocknote-extensions v0.0.22 release.

Workarounds

• Disable real-time collaboration in document settings until the patch can be applied
• Restrict collaborative document creation and editing to trusted users only
• Implement network segmentation to limit the impact of potential SSRF exploitation
• Deploy WAF rules to filter requests containing path traversal patterns in work package ID parameters

# Configuration example - Disable collaborative editing in OpenProject
# Navigate to: Administration -> Settings -> Documents
# Set "Real time collaboration" to Disabled

# Alternative: Update to patched version
# For Docker deployments:
docker pull openproject/community:17.0.2
docker-compose up -d

# For package-based installations, follow upgrade documentation
# Verify version after upgrade:
openproject run bundle exec rails runner "puts OpenProject::VERSION.to_s"