CVE-2026-44696: OpenProject: Stored CSS injection via Sanitize::Config::RELAXED[:css] enables phishing overlays and data exfiltration
OpenProject is open-source, web-based project management software. Prior to 17.4.0, OpenProject's rich text (markdown) rendering pipeline uses Sanitize::Config::RELAXED[:css] for inline style sanitization. This configuration permits essentially all CSS properties in style attributes on permitted HTML elements (figure, img, table, th, tr, td). This allows any authenticated user with write access to formattable text fields (work package descriptions, comments, project descriptions, news) to inject CSS This vulnerability is fixed in 17.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenProjectto a version that resolves this vulnerability.Fixed in 17.4.0 - Compensating control
Restrict authenticated users’ write access to formattable text fields (e.g., work package descriptions, comments, project descriptions, news) until all instances are upgraded, to reduce the ability to inject CSS via Sanitize::Config::RELAXED[:css].
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44696?
CVE-2026-44696 has a medium severity score of 5.7.
How do I fix CVE-2026-44696?
To fix CVE-2026-44696, update OpenProject to version 17.4.0 or later.
What types of attacks does CVE-2026-44696 facilitate?
CVE-2026-44696 facilitates phishing overlays and data exfiltration through stored CSS injection.
Which versions of OpenProject are affected by CVE-2026-44696?
OpenProject versions prior to 17.4.0 are affected by CVE-2026-44696.
Is user interaction required to exploit CVE-2026-44696?
Yes, CVE-2026-44696 requires user interaction to execute the attack.