OpenProject’s rich text rendering allows authenticated users with write access to inject any CSS property through the style attribute on permitted elements; this Stored CSS Injection can be used to create phishing overlays or exfiltrate data. The vulnerability falls under CWE-79, highlighting a deficiency in input validation for markup styles.

The affected software is OpenProject; all releases earlier than version 17.4.0 are vulnerable, including work package descriptions, comments, project descriptions, and news fields that support markdown formatting.

The CVSS score of 5.7 indicates medium severity. The exploitation requires an authenticated user with write rights rather than a purely remote attacker, so the impact is limited to users with such permissions. Because the EKSS score is unavailable and the vulnerability is not listed in KEV, there is no evidence of active exploitation, but the ability to overlay phishing pages presents a significant threat to self‑service users and administrators.