CVE-2026-44734
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedOpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, a Missing Authorization vulnerability exists in OpenProject's CostReportsController. The rename and update actions allow any authenticated user to modify the name, filters, and grouping of any Public cost report in the system without verifying ownership or permission level. An attacker who discovers or guesses a public report's numeric ID can rename or overwrite its filter configuration without any warning to the report's owner. This vulnerability is fixed in 17.3.2 and 17.4.0.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceOpenProject prior to 17.3.2 and 17.4.0 contains a Missing Authorization vulnerability in the CostReportsController where the rename and update actions fail to verify user ownership or permissions before allowing modifications to public cost reports. Any authenticated user can modify the name, filters, and grouping of any public cost report by knowing or guessing its numeric ID.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify OpenProject versionLocate the installed OpenProject version - typically visible in the application footer, or via command line (e.g., 'openproject --version') or by inspecting the Gemfile.lock in the installation directoryAffected if Version is prior to 17.3.2 or is 17.4.0 (any version below the fixed releases)
-
Confirm Cost Reports module is enabledCheck if the Cost Reports module is active in the project where cost reports are stored - this can be verified through the OpenProject administration interface under Project settings or via API query to the projects endpointAffected if The Cost Reports module is enabled and accessible to authenticated users
-
Verify public cost reports existCheck for any cost reports marked as public within OpenProject - query the cost reports API endpoint or review the visibility settings on existing cost reports in the Cost Reports moduleAffected if At least one public cost report exists that could be accessed by any authenticated user
-
Check for unauthorized modificationsReview the audit log or activity log for cost reports to identify any rename or update actions performed by users who should not have ownership or administrative permissions on those specific reportsAffected if Modification entries exist for cost reports performed by users who are not the owners or administrators of those reports
The environment is affected if OpenProject version is below 17.3.2 or is 17.4.0, the Cost Reports module is enabled, and public cost reports are present, allowing any authenticated user to modify them without proper authorization checks.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedUpgrade OpenProject to version 17.3.2 or 17.4.0 which includes the authorization fix. Verify that proper permission checks are enforced on the rename and update actions for cost reports.
17.3.2 or 17.4.0
- Identify current OpenProject version by checking the administration panel or running `openproject --version`
- Review the upgrade path documentation at https://www.openproject.org/docs/installation-and-operations/upgrading/
- For packaged installations: Run `apt-get update && apt-get install openproject` (Debian/Ubuntu) or `yum update openproject` (RHEL/CentOS)
- For Docker installations: Pull the new image with `docker pull openproject/community:17.3.2` or `docker pull openproject/community:17.4.0` and recreate the container
- For source installations: Update the code to the specific tag (e.g., `git fetch && git checkout v17.3.2` or `git checkout v17.4.0`) and run bundle install and database migrations
- Run database migrations with `rake db:migrate` (source) or through the packaged upgrade process
- Verify the upgrade by checking the administration panel shows version 17.3.2 or 17.4.0
- Test that cost report rename/update actions now properly verify ownership/permissions
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation3.0 h
- Implementation4.0 h
- Testing4.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,648.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-44734 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-44734 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data