CVE-2026-30239: OpenProject has a Permission Check bypass on Budget deletion allows reassignment of WorkPackages into other budgets
OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when budgets are deleted, the work packages that were assigned to this budget need to be moved to a different budget. This action was performed before the permission check on the delete action was executed. This allowed all users in the application to delete work package budget assignments. This vulnerability is fixed in 17.2.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30239?
CVE-2026-30239 has been classified as a medium severity vulnerability due to the potential for unauthorized budget deletion leading to work package reassignment.
How do I fix CVE-2026-30239?
To fix CVE-2026-30239, upgrade OpenProject to version 17.2.0 or later to ensure that proper permission checks are in place.
What are the consequences of CVE-2026-30239?
The consequences of CVE-2026-30239 include the risk of unauthorized deletion of budgets which may lead to mismanagement of work packages.
Which versions of OpenProject are affected by CVE-2026-30239?
OpenProject versions prior to 17.2.0 are affected by CVE-2026-30239 and are susceptible to the permission check bypass.
Is there a workaround for CVE-2026-30239 if I cannot upgrade?
There is no documented workaround for CVE-2026-30239, so upgrading is the recommended course of action.