There is an Insecure Direct Object Reference (IDOR) in the MeetingAgendaItemsController#move_to_section endpoint. This allows an authenticated user to perform Meeting Agenda Pollution by moving their own agenda items into any meeting section of any other project.
While the initial agenda item is loaded from the authorized meeting context, the controller fails to validate that the target meeting_section_id belongs to the same project or a project where the user has permission.
Credits
This vulnerability was reported by user Herdiyan Adam Putra (herdiyanitdev) as part of the YesWeHack.com OpenProject Bug Bounty program, sponsored by the European Commission.
There is an Insecure Direct Object Reference (IDOR) in the
MeetingAgendaItemsController#move_to_section endpoint. This allows an authenticated user to perform Meeting Agenda Pollution by moving their own agenda items into any meeting section of any other project.While the initial agenda item is loaded from the authorized meeting context, the controller fails to validate that the target
meeting_section_idbelongs to the same project or a project where the user has permission.Credits
This vulnerability was reported by user Herdiyan Adam Putra (herdiyanitdev) as part of the YesWeHack.com OpenProject Bug Bounty program, sponsored by the European Commission.