OpenProject Budget Deletion Permission Check Bypass Vulnerability Allowing Work Package Reassignment

A vulnerability exists in OpenProject versions prior to 17.2.0, where the permission check for deleting budgets was not properly enforced. When a budget is deleted, the associated work packages must be reassigned to a different budget. However, the deletion process allowed all users to remove work package budget assignments without the necessary permissions. This issue has been addressed in version 17.2.0.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of work package budget assignments, allowing users to manipulate budget allocations without proper oversight.

Remediation

Users can upgrade to OpenProject version 17.2.0 or later to address this vulnerability.