Security Overview · opf/openproject · GitHub

Security

Report a vulnerability

SECURITY.md

Please find our statement on security in this document: https://www.openproject.org/docs/security-and-privacy/statement-on-security/

Users can delete other user's session, causing them to be logged out
GHSA-w422-xf8f-v4vp published Jan 19, 2026 by klaustopher

Moderate
Users with "View Members" permission in any project can view all Group memberships
GHSA-vj77-wrc2-5h5h published Jan 19, 2026 by klaustopher

Moderate
Stored XSS regression on OpenProject using attachments and script-src self
GHSA-cvpq-cc56-gwxx published Jan 19, 2026 by klaustopher

High
Arbitrary File Read via ImageMagick SVG Coder
GHSA-m8f2-cwpq-vvhh published Jan 9, 2026 by oliverguenther

Critical
Insecure Direct Object Reference in Meetings
GHSA-fq4m-pxvm-8x2j published Jan 9, 2026 by oliverguenther

Moderate
No protection against brute-force attacks in the Change Password function
GHSA-93x5-prx9-x239 published Jan 9, 2026 by oliverguenther

Moderate
User enumeration via the change password function
GHSA-q7qp-p3vw-j2fh published Jan 9, 2026 by oliverguenther

Moderate
User Enumeration via User ID
GHSA-7fvx-9h6h-g82j published Jan 9, 2026 by oliverguenther

Low
Code Execution in E-Mail function
GHSA-9vrv-7h26-c7jc published Jan 9, 2026 by oliverguenther

High
Stored HTML injection
GHSA-mg4q-ghvh-cm2j published Feb 10, 2025 by oliverguenther

Low

Learn more about advisories related to opf/openproject in the GitHub Advisory Database