OpenProject versions prior to 17.3.3 and 17.4.1 contain a cross‑project IDOR that lets a user with project‑management rights delete shared or public Calendar or Team Planner queries from another project where they lack those rights. The vulnerability enables removal of metadata that users rely on for collaboration, thereby corrupting the integrity of project data and causing a limited loss of availability for teams dependent on those shared views.

The affected application is OpenProject, an open‑source, web‑based project management tool. The flaw exists in all versions before 17.3.3 and 17.4.1 and impacts the Calendar and Team Planner modules.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score is unavailable, so the likelihood of exploitation is uncertain. The vulnerability is not listed in CISA’s KEV catalog. An attacker with management permissions on one project can craft a URL containing the target project’s ID and the query's ID; the application subsequently loads the query without verifying that it belongs to the requested project, allowing the deletion. This attack requires only an authenticated session and no additional privileges beyond existing project management rights.