Technical impact
The vulnerability in OpenProject allows an attacker who has the manage_agendas permission in any project to inject agenda items into meetings belonging to projects the attacker has no access to. The flaw resides in an unscoped section lookup that permits the attacker to specify arbitrary section identifiers, leading to creation of agenda items in any meeting without needing to discover target project details. This cross‑project injection can deface meeting agendas, insert misleading information, or facilitate social engineering attacks. The weakness is related to unauthorized data manipulation (CWE‑367, CWE‑639).
Affected Systems
Versions of OpenProject prior to 17.3.0 are affected. Any instance running a vulnerable version and with users granted the manage_agendas permission for any project can be exploited. The vulnerability does not depend on specific application modules or operating systems; it is purely a feature logic flaw in the OpenProject application code.
Risk and Exploitability
The CVSS score of 6.5 indicates medium severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it is not known to be actively exploited yet. An attacker only needs a legitimate user account with manage_agendas permission; no additional knowledge of target meetings or projects is required, so the attack vector is internal and can be executed by a malicious user with standard project‑level privileges. The lack of advanced privilege escalation or credential compromise makes the exploitation straightforward for anyone with the required permission.
