The vulnerability is a Missing Authorization flaw (CWE‑862) in the CostReportsController. The rename and update actions permit any authenticated user to change the name, filters, and grouping of any public cost report, circumventing ownership checks. An attacker who learns or guesses a public report’s numeric identifier can rename the report or overwrite its filter configuration without the owner’s knowledge, potentially compromising reporting accuracy and data integrity.

Affected products are OpenProject web‑based project management software from the opf organization. Versions prior to 17.3.2 and 17.4.0 are vulnerable; all builds before those releases should be considered affected until the patch is applied.

The flaw carries a CVSS score of 6.5, indicating moderate severity. Exploitation requires an authenticated account, and the attacker must locate a public report identifier. The EPSS score is unavailable, and the issue is not listed in the CISA KEV catalog. Although the attack vector is limited to authenticated users, the lack of authorization checks makes the vulnerability exploitable in environments where many users have public report access.