Security Overview · opf/openproject · GitHub

⚠ This page is served via a proxy. Original site: https://github.com
This service does not collect credentials or authentication data.

Security

Report a vulnerability

SECURITY.md

Please find our statement on security in this document: https://www.openproject.org/docs/security-and-privacy/statement-on-security/

Forced Actions, Content Spoofing, and Persistent DoS via ID Manipulation in OpenProject Blocknote Editor Extension
GHSA-35c6-x276-2pvc published Jan 28, 2026 by oliverguenther

Moderate
Argument Injection on Repository Diff allows Arbitrary File Write and Remote Code Execution
GHSA-74p5-9pr3-r6pw published Jan 28, 2026 by oliverguenther

Critical
SSRF and CSWSH in Hocuspocus Synchronization Server
GHSA-r854-p5qj-x974 published Jan 28, 2026 by oliverguenther

High
Users can delete other user's session, causing them to be logged out
GHSA-w422-xf8f-v4vp published Jan 19, 2026 by klaustopher

Moderate
Users with "View Members" permission in any project can view all Group memberships
GHSA-vj77-wrc2-5h5h published Jan 19, 2026 by klaustopher

Moderate
Stored XSS regression on OpenProject using attachments and script-src self
GHSA-cvpq-cc56-gwxx published Jan 19, 2026 by klaustopher

High
Arbitrary File Read via ImageMagick SVG Coder
GHSA-m8f2-cwpq-vvhh published Jan 9, 2026 by oliverguenther

Critical
Insecure Direct Object Reference in Meetings
GHSA-fq4m-pxvm-8x2j published Jan 9, 2026 by oliverguenther

Moderate
No protection against brute-force attacks in the Change Password function
GHSA-93x5-prx9-x239 published Jan 9, 2026 by oliverguenther

Moderate
User enumeration via the change password function
GHSA-q7qp-p3vw-j2fh published Jan 9, 2026 by oliverguenther

Moderate

Learn more about advisories related to opf/openproject in the GitHub Advisory Database