CVE-2026-44734: openproject < 17.3.2

CVE-2026-44734. CVSS 3.1 base score 6.5 (MEDIUM, Vendor/CNA). EPSS 0.00326 (percentile 0.24486), scored 24-Oct-2026.

Affected technology

openproject · < 17.3.2
opf

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Any authenticated user can modify the name, filters, and grouping of any Public cost report in the system without verifying ownership or permission level. Vendor/CNA’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality and availability impact as none; integrity impact as high.

Published 25-Oct-2026 19:52 UTC

CWE: CWE-862
CCR priority: 26.1 /100 (P4)
CVSS 3.1: 6.5 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · Vendor/CNA
EPSS: 0.00326 · percentile 0.2543 · 2026-10-25
KEV: no

Provenance

FIRST EPSS daily exploit-probability · Source record · observed 2026-10-25 19:52:47.952465+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-25 19:51:06.643138+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-44734.html