CVE-2026-44732: OpenProject Auth Bypass Vulnerability

CVE-2026-44732 Overview

CVE-2026-44732 is an authorization bypass vulnerability in OpenProject, an open-source web-based project management platform. The flaw exists in the document update endpoint, where attacker-controlled attributes are applied to a persisted record before authorization checks complete. An authenticated user without the :manage_documents permission in the source project can move and modify documents belonging to foreign projects by supplying a project_id value in a single PATCH request. The issue is tracked under CWE-639: Authorization Bypass Through User-Controlled Key and is fixed in OpenProject 17.3.2 and 17.4.0.

Critical Impact
Authenticated users can modify and relocate documents across projects they do not have permission to manage, breaking project isolation boundaries.

Affected Products

OpenProject versions prior to 17.3.2
OpenProject 17.4.0 pre-release builds
Any OpenProject deployment exposing the document update endpoint to authenticated users

Discovery Timeline

2026-06-26 - CVE-2026-44732 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-44732

Vulnerability Analysis

OpenProject exposes a PATCH endpoint used to modify existing documents. The controller loads the target document with visibility checks, ensuring the requesting user can see the record. The controller then applies user-supplied attributes to the ActiveRecord object before verifying whether the user holds :manage_documents in the correct project scope.

The ordering flaw means the persisted record accepts attacker-controlled values, including project_id, prior to the permission gate. An authenticated user submits a PATCH request against a document they can view and includes a project_id pointing at a different project. The record is updated, effectively moving the document into a project the attacker controls or altering document metadata across project boundaries.

Root Cause

The root cause is a Broken Object Level Authorization pattern documented in CWE-639. Visibility checks confirm the actor can read the record but do not confirm the actor can write to the destination project. Mass assignment of the project_id attribute is treated as trusted input, letting the client rebind the resource to a project scope where authorization was never evaluated.

Attack Vector

Exploitation requires an authenticated account with read access to the target document and network reach to the OpenProject application. No user interaction is required beyond issuing a single PATCH request that includes a project_id field targeting a foreign project. Successful requests result in integrity impact against documents belonging to projects outside the attacker's permission set. Confidentiality and availability are not directly affected according to the published CVSS vector.

See the OpenProject GitHub Security Advisory GHSA-mqvv-5mvc-7pg7 for the vendor's technical description.

Detection Methods for CVE-2026-44732

Indicators of Compromise

PATCH requests to document endpoints containing a project_id parameter that differs from the document's originating project
Audit log entries showing documents changing project_id without a corresponding administrative action
Users triggering document updates in projects where they lack the :manage_documents permission

Detection Strategies

Review OpenProject application logs for PATCH requests to /api/v3/documents/{id} or equivalent update routes that include project_id in the payload
Correlate document ownership transitions with the requesting user's role assignments to flag cross-project movement
Alert on ActiveRecord audit trail entries where project_id changes on document records, especially when initiated by non-admin users

Monitoring Recommendations

Enable OpenProject's audit logging and forward events to a centralized log platform for retention and correlation
Baseline normal document update patterns per user and alert on deviations involving cross-project attribute changes
Monitor authentication events tied to accounts that subsequently perform document modifications on projects they do not administer

How to Mitigate CVE-2026-44732

Immediate Actions Required

Upgrade OpenProject to version 17.3.2 or 17.4.0, which enforce authorization prior to attribute assignment
Inventory existing documents for unauthorized project_id changes since the vulnerability was introduced and restore any affected records
Review role assignments and revoke document access from accounts that do not require it

Patch Information

The OpenProject maintainers fixed CVE-2026-44732 in versions 17.3.2 and 17.4.0. The patch enforces the :manage_documents permission check against both the source and destination project before applying attribute changes. Refer to the OpenProject Security Advisory GHSA-mqvv-5mvc-7pg7 for release notes and upgrade guidance.

Workarounds

Restrict document access at the project role level to trusted users until the upgrade is completed
Place a reverse proxy or web application firewall rule in front of OpenProject to block PATCH requests to document endpoints that include a project_id field
Disable the documents module for projects that do not require it to reduce the attack surface

bash

# Example WAF rule concept: block PATCH requests to document endpoints containing project_id
# ModSecurity example
SecRule REQUEST_METHOD "@streq PATCH" \
  "chain,phase:2,deny,status:403,id:1044732,\
   msg:'CVE-2026-44732 - blocked cross-project document update'"
  SecRule REQUEST_URI "@rx ^/api/v3/documents/[0-9]+" \
    "chain"
    SecRule REQUEST_BODY "@contains project_id" "t:lowercase"