CVE-2026-22605

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-22605

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22605.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-22605

Aliases

GHSA-fq4m-pxvm-8x2j

Published

2026-01-10T01:07:10.412Z

Modified

2026-08-12T03:51:10.720214026Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

OpenProject is Vulnerable to Insecure Direct Object Reference in Meetings

Details

OpenProject is an open-source, web-based project management software. OpenProject versions prior to version 16.6.3, allowed users with the View Meetings permission on any project, to access meeting details of meetings that belonged to projects, the user does not have access to. This issue has been patched in version 16.6.3.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-284"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22605.json"
}

References

Affected packages

Git / github.com/opf/openproject

Affected ranges

Type

GIT

Repo

https://github.com/opf/openproject

Events

Introduced

Fixed

3aeec0bfb7b7a7162dcc48bee5a74d5f88592cdb

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "16.6.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*"
}

Affected versions

v16.*

v16.0.0

v16.0.1

v16.1.0

v16.1.1

v16.2.0

v16.2.1

v16.2.2

v16.3.0

v16.3.1

v16.3.2

v16.4.0

v16.4.1

v16.5.0

v16.5.1

v16.6.0

v16.6.1

v16.6.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22605.json"