A missing authorization flaw in OpenProject allows authenticated users to perform unauthorized actions, potentially leading to significant data integrity compromise.

This vulnerability is a missing authorization flaw (CWE-862) that occurs when the application fails to properly verify user permissions before executing sensitive functions. The attack requires the attacker to be an authenticated user with low privileges to exploit the oversight.

Successful exploitation allows an authenticated user to perform actions they are not authorized to execute. Given the CVSS score of 7.6, this represents a high-severity risk to business operations, as it could lead to unauthorized data modification, project manipulation, or escalation of privilege within the project management environment.

Immediate Action: Upgrade OpenProject to version 17.6.0 or later to include the required authorization checks.

Proactive Monitoring: Review audit logs for unusual patterns of administrative or unauthorized activity performed by standard user accounts.

Compensating Controls: Implement strict Role Based Access Control (RBAC) policies and restrict access to the OpenProject instance to trusted network segments.

Public Exploit Available: Unknown

The high CVSS score reflects the potential for serious unauthorized modification of project data. Administrators should prioritize updating to version 17.6.0 immediately to ensure that all internal authorization mechanisms are properly enforced and to prevent potential abuse by malicious internal actors.