https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 21:05:32 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-330942 EUVD-2026-330942 https://cve.radiocsirt.org/vuln/euvd-2026-330942 https://cve.radiocsirt.org/vuln/fkie_cve-2026-52782 <p>OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is an IDOR through /projects/&lt;A&gt;/settings/project_storages/&lt;A_ps_id&gt; via PATCH parameter &#34;storages_project_storage[project_folder_id]&#34; leads to Access to Unauthorized Resources. A project-admin in one project can hijack the managed Nextcloud or OneDrive folder of another project on the same storage by writing the victim project&#39;s project_folder_id into the attacker&#39;s Storages::ProjectStorage row. The next managed-folder sync overwrites the ACL on the referenced folder with the attacker project&#39;s user list. This vulnerability is fixed in 17.3.3 and 17.4.1.</p> <p>OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is an IDOR through /projects/&lt;A&gt;/settings/project_storages/&lt;A_ps_id&gt; via PATCH parameter &#34;storages_project_storage[project_folder_id]&#34; leads to Access to Unauthorized Resources. A project-admin in one project can hijack the managed Nextcloud or OneDrive folder of another project on the same storage by writing the victim project&#39;s project_folder_id into the attacker&#39;s Storages::ProjectStorage row. The next managed-folder sync overwrites the ACL on the referenced folder with the attacker project&#39;s user list. This vulnerability is fixed in 17.3.3 and 17.4.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-52782