CVE-2026-30239 OpenProject has a Permission Check bypass on Budget deletion allows reassignment of WorkPackages into other budgets

OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when budgets are deleted, the work packages that were assigned to this budget need to be moved to a different budget. This action was performed before the permission check on the delete action was executed. Thi...

CVE-2026-30239

OpenProject prior to 17.2.0 has a permission check order issue: when deleting budgets, work packages assigned to that budget could be deleted by any user because the deletion action’s permission check ran after the delete. This allowed unintended deletion of budget assignments. The issue is fixed...