CVE-2026-44734 Overview
CVE-2026-44734 is a missing authorization vulnerability in OpenProject, an open-source web-based project management platform. The flaw resides in the CostReportsController, where the rename and update actions fail to verify ownership or permission level. Any authenticated user can modify the name, filters, and grouping of any Public cost report by supplying its numeric identifier. The issue is tracked under [CWE-862] and affects OpenProject versions prior to 17.3.2 and 17.4.0.
Critical Impact
Authenticated users can tamper with any public cost report's configuration without notification to the owner, corrupting reporting integrity across the platform.
Affected Products
- OpenProject versions prior to 17.3.2
- OpenProject versions prior to 17.4.0
- OpenProject CostReportsController component
Discovery Timeline
- 2026-06-26 - CVE-2026-44734 published to NVD
- 2026-06-27 - Last updated in NVD database
Technical Details for CVE-2026-44734
Vulnerability Analysis
The vulnerability affects OpenProject's cost reporting module. The CostReportsController exposes rename and update actions that alter persisted report metadata, including the report name, filter set, and grouping configuration. These actions require authentication but do not check whether the caller owns the report or holds an administrative role over public reports.
An authenticated attacker who knows or guesses the numeric identifier of a Public cost report can issue a request to these actions and overwrite the report's stored configuration. The owner receives no warning that their report was modified. Impact is scoped to integrity of report objects rather than confidentiality or availability of the wider system.
Root Cause
The root cause is a missing authorization check on state-changing controller actions. OpenProject enforces authentication but does not validate the relationship between the authenticated principal and the target report object. This is a classic [CWE-862] Missing Authorization pattern where access control logic is absent from a privileged code path.
Attack Vector
Exploitation is network-based and requires low-privilege authenticated access. An attacker enumerates or guesses numeric report IDs and submits requests to the rename or update endpoints on the CostReportsController. Successful requests replace filter definitions and grouping, which can misdirect downstream financial reporting and audits. Technical details are documented in the GitHub Security Advisory GHSA-c767-34gh-gh2h.
Detection Methods for CVE-2026-44734
Indicators of Compromise
- Unexpected changes to the name, filters, or grouping attributes of Public cost reports in the OpenProject database.
- HTTP requests to CostReportsControllerrename or update actions originating from user accounts that do not own the targeted report.
- Sequential access patterns against numeric cost report IDs suggesting enumeration.
Detection Strategies
- Compare current report configurations against known-good backups or version-controlled exports to identify unauthorized modifications.
- Enable and review OpenProject application logs for POST or PATCH requests to cost report endpoints, correlating actor identity with report ownership records.
- Alert on any modification of Public cost reports performed by non-administrator, non-owner accounts.
Monitoring Recommendations
- Forward OpenProject web server and application logs to a centralized log analytics platform for retention and querying.
- Track authentication events alongside cost report modification events to attribute changes to specific users.
- Establish a baseline of normal report edit frequency per user and alert on deviations.
How to Mitigate CVE-2026-44734
Immediate Actions Required
- Upgrade OpenProject to version 17.3.2 or 17.4.0 or later without delay.
- Audit all Public cost reports for unauthorized modifications since deployment, restoring configurations from backup where necessary.
- Review authenticated user accounts and revoke access for stale or unnecessary identities to reduce the attacker population.
Patch Information
OpenProject addressed this issue in versions 17.3.2 and 17.4.0. The fix adds authorization checks to the rename and update actions in the CostReportsController so that only users with appropriate ownership or permissions can modify a Public cost report. Refer to the GitHub Security Advisory GHSA-c767-34gh-gh2h for full remediation guidance.
Workarounds
- Restrict OpenProject access to trusted users until the patch can be applied, minimizing the pool of accounts able to invoke the vulnerable actions.
- Convert sensitive Public cost reports to Private where feasible, since the vulnerability targets Public reports specifically.
- Take a verified backup of the cost reports database table so that any tampering can be detected and reversed after patching.
# Configuration example: upgrade OpenProject via package manager
sudo apt-get update
sudo apt-get install --only-upgrade openproject
sudo openproject configure
sudo openproject run rake db:migrate
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
