CVE-2026-52785: OpenProject: SQL injection in timestamps functionality

Synopsis

SQL injection in the timestamps functionality of OpenProject, an open-source web-based project management platform. The vulnerability is reachable over the network by any authenticated user with a low-privilege account, and no victim interaction is required. Successful exploitation gives an attacker full read and write access to the underlying database, crossing trust boundaries beyond the originating session. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment the upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the OpenProject service over the network; the CVSS vector specifies AV:N, meaning the vulnerable endpoint is exposed to any network-adjacent client.

• AuthenticationRequired

  A valid account is required, but any low-privilege user account is sufficient; the CVSS vector specifies PR:L, meaning no administrative rights are needed.

• Victim interactionNot required

  The attacker can exploit this vulnerability without any action from another user; the CVSS vector specifies UI:N.

• Attack complexityDetail

  The exploit is reliable and condition-free; the CVSS vector specifies AC:L, meaning no race conditions or special environmental factors must align.

Blast Radius

• Reads arbitrary rows from the database, including work-package records, user credentials, session tokens, and any other data accessible to the database role.
• Modifies or deletes persisted database rows, allowing an attacker to corrupt project data, escalate privileges, or plant malicious records.
• The scope of impact crosses the originating application boundary (CVSS S:C), meaning database contents shared by other application components or tenants can also be affected.
• Availability impact is rated Low, meaning targeted queries can degrade query performance or lock specific rows, causing partial service disruption without a full crash.