CVE-2026-52779: OpenProject Auth Bypass Vulnerability

CVE-2026-52779 Overview

CVE-2026-52779 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in OpenProject, an open-source web-based project management platform. The flaw resides in the Calendar and Team Planner modules, where authorization context is evaluated against the project identified in the URL rather than the project that owns the target Query object. An authenticated user with management permissions in one project can delete public Calendar or Team Planner Queries belonging to a different project. OpenProject versions prior to 17.3.3 and 17.4.1 are affected.

Critical Impact
An authenticated attacker with limited privileges in any project can delete shared Calendar or Team Planner views from unrelated projects, causing integrity and availability impact for users relying on those shared views.

Affected Products

OpenProject versions prior to 17.3.3
OpenProject versions in the 17.4 branch prior to 17.4.1
Calendar and Team Planner modules within affected OpenProject installations

Discovery Timeline

2026-06-26 - CVE-2026-52779 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-52779

Vulnerability Analysis

The vulnerability is a cross-project authorization context confusion in the Calendar and Team Planner controllers. When a delete request arrives, OpenProject authorizes the action against the project referenced by the :project_id URL parameter. The application then loads the actual Query object separately using the :id parameter through Query.visible(current_user). The scope Query.visible only checks whether the current user can see the Query, not whether the Query belongs to the authorized project. As a result, the authorization decision and the object retrieval operate on two different resources, breaking the reference monotonicity expected by the access control model.

Root Cause

The root cause is a missing ownership check between the authorized project and the loaded Query object. The controller trusts that :project_id and :id refer to related resources without validating the relationship. This is a textbook Insecure Direct Object Reference pattern where the object identifier is user-controlled and not constrained by the authorization scope.

Attack Vector

An attacker authenticated to OpenProject requires management permissions in at least one project (Project A). The attacker crafts a delete request that targets Project A in the URL path while referencing the numeric identifier of a public Calendar or Team Planner Query owned by Project B. Because Query.visible(current_user) returns any Query the user is allowed to view, and public Queries are broadly visible, the controller loads the target Query and executes the deletion. No user interaction is required from victims. See the OpenProject GitHub Security Advisory for the underlying code paths.

Detection Methods for CVE-2026-52779

Indicators of Compromise

Unexpected deletion events for public Calendar or Team Planner Queries in OpenProject audit logs.
HTTP DELETE requests where the :project_id in the URL does not match the parent project of the referenced Query :id.
User reports of missing shared Calendar or Team Planner views that previously existed.

Detection Strategies

Review OpenProject application logs for DELETE requests to Calendar and Team Planner Query endpoints and correlate the project_id path segment with the Query owner recorded in the database.
Alert when a single authenticated user issues Query deletions across multiple distinct projects within a short window.
Monitor for deletion actions performed by users whose role in the URL-referenced project does not typically include Query management.

Monitoring Recommendations

Enable verbose audit logging for the Calendar and Team Planner modules and forward events to a centralized log store.
Track the ratio of Query deletions to Query creations per user to surface anomalous destructive activity.
Retain database snapshots or logical backups of the queries table to support rapid restoration if malicious deletion is detected.

How to Mitigate CVE-2026-52779

Immediate Actions Required

Upgrade OpenProject installations to version 17.3.3 or 17.4.1 as soon as maintenance windows allow.
Audit recent Calendar and Team Planner Query deletions across all projects for cross-project anomalies.
Review project role assignments and remove management permissions from users who do not require them.

Patch Information

The vulnerability is fixed in OpenProject 17.3.3 and 17.4.1. The patched controllers verify that the Query loaded by :id belongs to the project identified by :project_id before authorizing the delete action. Details are published in the OpenProject GitHub Security Advisory GHSA-jrx5-px3f-vfq4.

Workarounds

Restrict Calendar and Team Planner management permissions to a minimal set of trusted users until the patch is applied.
Where feasible, convert critical shared Queries to private ownership by trusted administrators to reduce the pool of publicly visible targets.
Maintain frequent backups of OpenProject data so that improperly deleted Queries can be restored.

bash

# Configuration example: verify installed OpenProject version
sudo openproject run rails runner "puts OpenProject::VERSION::STRING"

# Upgrade via package manager (Debian/Ubuntu example)
sudo apt-get update
sudo apt-get install --only-upgrade openproject
sudo openproject configure