Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with `manage_agendas` permission in any project can inject agenda items into meetings belonging to any other project on the instance — even projects they have no access to. No knowledge of the target project, meeting, or victim is required; the attacker can blindly spray items into every meeting on the instance by iterating sequential section IDs. Version 17.3.0 patches the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-40896 OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with `manage_agendas` permission in any project can inject agenda i… https://www.cve.org/CVERecord?id=CVE-2026-40896
Post summary
The snippet announces a new CVE in OpenProject, detailing an injection vulnerability tied to manage_agendas permission, but offers no PoC, exploit code, active usage reports, or patch information.
CVE-2026-40896 Unauthorized Agenda Item Injection in OpenProject Versions Prior to 17.3.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40896
Post summary
The post announces a new CVE (CVE-2026-40896) describing an unauthorized agenda item injection flaw in older OpenProject releases, with no indication of PoC, exploit code, or active attacks.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openproject | openproject | - | - | - |