{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-01T22:53:11.360","vulnerabilities":[{"cve":{"id":"CVE-2026-30239","sourceIdentifier":"security-advisories@github.com","published":"2026-03-11T17:16:57.773","lastModified":"2026-06-17T10:32:32.813","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when budgets are deleted, the work packages that were assigned to this budget need to be moved to a different budget. This action was performed before the permission check on the delete action was executed. This allowed all users in the application to delete work package budget assignments. This vulnerability is fixed in 17.2.0."},{"lang":"es","value":"OpenProject es un software de gestión de proyectos de código abierto y basado en la web. Antes de la versión 17.2.0, cuando se eliminan presupuestos, los paquetes de trabajo que estaban asignados a ese presupuesto deben ser movidos a un presupuesto diferente. Esta acción se realizaba antes de que se ejecutara la verificación de permisos sobre la acción de eliminación. Esto permitía a todos los usuarios de la aplicación eliminar las asignaciones de presupuesto de los paquetes de trabajo. Esta vulnerabilidad se corrige en la versión 17.2.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"opf","product":"openproject","versions":[{"version":"< 17.2.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-11T17:09:51.784375Z","id":"CVE-2026-30239","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*","versionEndExcluding":"17.2.0","matchCriteriaId":"4FB19C4D-0273-43F6-9AF6-3D30795D43BB"}]}]}],"references":[{"url":"https://github.com/opf/openproject/security/advisories/GHSA-gpvh-g967-g4h8","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}}]}