OpenProject - Package Updates

Package Updates

[3.48.2]

Update openproject to 17.3.2
Full Changelog
GHSA-r85r-gjq2-f83r - Docker Container starts with SECRET_KEY_BASE default value
CVE-2026-44731 - Improper Access Control on OpenProject through /projects/[projectName]/meetings via "invited_user_id" in GET parameter "filters" leads to user names disclosure
CVE-2026-44732 - IDOR on OpenProject through /api/v3/documents/{id} via PATCH parameter "project_id" leads to Unauthorized Modification of Resources
CVE-2026-44733 - Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass password requirements
CVE-2026-44734 - Improper Access Control on OpenProject through the POST request to /projects/[PROJECT_NAME]/cost_reports/[REPORT_ID]/rename
CVE-2026-44735 - Shares API Information Disclosure
Bugfix: Performance impact of large Markdown/HTML templates caused by the tagfilter GFM extension [#74151]
Bugfix: Budget widget breaks when lots of cost types defined [#74189]
Bugfix: Direct login prevents authentication from mobile app [#74569]

Package Updates

[3.49.0]

Update openproject to 17.4.0
Full Changelog
Feature: Add meetings and recurring meetings APIv3 endpoints [#32280]
Feature: Workflow UX improvement: Apply workflow setting from one role to another role [#72383]
Feature: Backlog buckets in "Backlog and sprints" view [#73081]
Feature: Allow webhook secrets for GitHub and Gitlab integrations [#73387]
Feature: Have a sprint start/complete button in the sprint header [#73402]
Feature: Backlog card draggable + one-click for side panel [#73473]
Feature: Add widget for upcoming meetings on project overview and home page and remove users widget [#73684]
Feature: Jira Migrator imports custom fields [#73147]
Bugfix: Users can execute custom actions despite conditions not applying [#74294]
Bugfix: Copying a work package with instance wide sharing leads to two projects sharing instance wide [#74721]

Package Updates

[3.49.1]

Update openproject to 17.4.1
Full Changelog
CVE-2026-47193 - Journal diff endpoint bypasses object, journal, and field visibility checks
CVE-2026-49355 - Private work package data disclosure through single meeting agenda item API
GHSA-3vpx-94qx-xpw6 - IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[project_folder_id]" leads to Access to Unauthorized Resources
GHSA-6crw-7f5r-4qj9 - CSRF on TARGET through /users/:id via POST parameter "user[admin]"
GHSA-98vw-2r87-fx2r - SQL injection in timestamps functionality
GHSA-h83w-5q5x-pq27 - Information Disclosure (cleartext storage of data) on localhost through memcached via Others "storage.<id>.httpx_access_token" leads to Sensitive Data Exposure
GHSA-q33w-f822-hg8x - Stored XSS on openproject.example.com through /api/v3/projects/{project}/work_packages via POST parameter "description"
GHSA-qj96-f42f-6336 - Cache store poisoning leads to Remote Code Execution (RCE)
Bugfix: Migration 2025092 failing due to update code failing on not-yet fully migrated schema [#75286]

Package Updates

[3.50.0]

Update openproject to 17.5.0
Full Changelog
Feature: Exclude certain work package types from automated backlog (per project) [#71305]
Feature: Jira Migrator imports project-based semantic issue identifiers [#72427]
Feature: Jira Migrator supports due date, estimated hours and remaining hours. [#74807]
Feature: Meeting series: Add monthly scheduling options [#61522]
Feature: Debounce emails for meetings [#66645]
Feature: Workflows UX improvement: Allow multi-selection of roles in workflow [#72242]
Feature: Bring sprint sharing (SAFe) to corporate plan [#74147]
Bugfix: POST/PATCH/DELETE requests to APIv3 return unauthorized [#73499]
Bugfix: Nextcloud integration shows "No connection to Nextcloud" for folders that have "&" in the name [#73855]
Bugfix: Wrong calendar week in My time tracking [#68272]

Package Updates

[3.50.1]

Update openproject to 17.5.1
Full Changelog
Bugfix: Capital letters in user email or login break import with error. [#75924]
Bugfix: Page scrolls down to the bottom if user clicks on WP description when top of description is out of screen [#74186]
Bugfix: Creation of new work packages and status transitions not possible aber upgrade to 17.5 [#75961]
Bugfix: Renaming of projects causes AMPF sync to fail [#76022]
Bugfix: Direct upload failing on SaaS since new prefix key is added [#75811]

Package Updates

[3.51.0]

Update openproject to 17.6.0
Full Changelog
Feature: Sprint goals [#71059]
Feature: XWiki integration [#53738]
Feature: "All sprints" view - simple list [#74594]
Feature: Display backlog bucket in work package [#73887]
Feature: Create work package out of Meeting Agenda Item [#57053]
Feature: Allow cost types to be enabled/disabled per project [#42037]
Feature: Escape possible control characters in CSV export [#75486]
POST/PATCH/DELETE /api/v3/meetings/:id/agenda_items) is no longer available, they have been moved to the /api/v3/meeting_agendas/ respectively. The same is true for outcomes and sections.
Bugfix: GET /api/v3/meetings/{id}/agenda_items returns incorrect section link format unusable for PATCH and POST requests [#75615]
Bugfix: User without save_cost_reports can save public cost reports [#76398]

Package Updates

[3.52.0]

Update openproject to 17.7.0
Full Changelog
Feature: Add multi-select drop-down for sprint and backlog buckets [#73611]
Feature: Multiple active sprints without sharing [#77079]
Feature: Adapt BCF Export and Import for semantic identifiers [#74362]
Feature: Show project attributes as separate tab in a WorkPackage [#75699]
Feature: Add a setting to disable users editing their own email address [#76754]
Feature: Filter project by portfolio and programm [#74718]
Feature: Global wiki page index [#76743]
Bugfix: Users can deleted descendent work packages in projects they are not authorized to [#76930]
Bugfix: Members: Changing a group's role results in a 404 error [#77450]
Bugfix: WebAuthn Form not submitting [#77298]

Package Updates

[3.52.1]

Update openproject to 17.7.1
Full Changelog
Bugfix: Retrying a stopped import creates duplicate OpenProject users [#78165]
Bugfix: Jira attachment authors are not created as users [#78168]
Bugfix: Resource management permissions not visible under Roles > Administration [#78202]
Bugfix: Wrong activation of project attributes in PIR [#78153]

Package Updates

[3.52.2]

Update openproject to 17.7.2
Full Changelog
Bugfix: The hourly rate cannot be adjusted for individual projects [#78111]
Bugfix: Non-working days saved while reschedule job is running are not applied to work packages [#78219]
Bugfix: Bubble with + in timeline view does not make sense [#78284]
Bugfix: When using multiple seeded custom styles, most are lost [#78397]

Package Updates

[3.53.0]

Update openproject to 17.8.0
Full Changelog
Feature: Sprints and backlog buckets can be updated on bulk updating work packages [#73103]
Feature: Add create_work_package MCP tool [#75408]
Feature: Introduce target versions replacing version [#76181]
Feature: Global restrictions/limits for time entries [#78132]
Feature: Display relations in the work package table to the community edition [#78598]
Feature: Add milestones to the project lifecycle widget [#76749]
Feature: Activity tab: Journalise and add information about when a work package is added or discussed in a meeting [#61057]
Bugfix: Both "Target version" and "Version" filters are present when target versions is enabled [#78408]
Bugfix: Meeting invitation email shows event shifted by +1 hour for dates between 2026-09-29 and 2026-10-24 [#77624]
Bugfix: Sprint names and assignments leaking through activity without view_sprints permission [#78436]

Cloudron Forum