CVE-2026-22605CWE-284

OpenProject is Vulnerable to Insecure Direct Object Reference in Meetings

Medium · published January 10, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
13.0
In the wild
Unconfirmed
What it is

OpenProject is an open-source, web-based project management software. OpenProject versions prior to version 16.6.3, allowed users with the View Meetings permission on any project, to access meeting details of meetings that belonged to projects, the user does not have access to. This issue has been patched in version 16.6.3.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00229 · 13.0th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-01-10T01:07Z
EPSS history
Timeline
  • 10 JAN 01:07Z
    OpenProject is Vulnerable to Insecure Direct Object Reference in Meetings
    cvelistv5