An insufficient access control flaw in OpenProject allows an authenticated user to create wiki pages that belong to projects they are not permitted to access. This flaw does not provide remote code execution or data exfiltration, but it enables an attacker to add, modify, or delete content in any project where they normally have no write authority. Such unauthorized creation can be used to deface, inject misleading information, or ship content that may later be linked to malicious campaigns. The vulnerability is characterized by CWEs that denote an authorization weakness in application logic.

The issue exists in OpenProject releases prior to 17.0.5 and 17.1.2. Any deployment using those earlier versions and not yet patched is susceptible. The vulnerability was publicly disclosed through the OpenProject releases and security advisory channels.

The CVSS score of 4.3 indicates medium severity. The EPSS of <1% suggests a low likelihood of widespread exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. The attack requires an authenticated session and the ability to craft a web request targeting the wiki creation endpoint; the vector is likely remote via standard HTTP(S) traffic. The low exploitation probability reflects the need for an access token and the scarcity of public exploitation evidence.