ETK-2026-4057Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-4057",
  "cve_id": null,
  "display_id": "ETK-2026-4057",
  "ghsa_id": "GHSA-pggp-67cq-xgrg",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Rich-text macro method invocation in OpenProject",
  "summary": "OpenProject rich-text attribute macros can invoke unintended public methods when processed for exports or email. An attacker with permission to create or edit rich text could use this to access otherwise unavailable record data or modify or remove records available to the user who triggers processing. Exploitation depends on the malicious content being exported or emailed.",
  "mitigation": "Upgrade OpenProject to 17.5.2, 17.6.1, 17.7.3, 17.9.7, 17.8.2 or later.",
  "vendor": "other",
  "product": "other:OpenProject",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 17.5.2"
      ],
      "ecosystem": "other",
      "fixed_versions": [
        "17.5.2",
        "17.6.1",
        "17.7.3",
        "17.9.7",
        "17.8.2"
      ],
      "package_name": "OpenProject",
      "purl": null
    }
  ],
  "cwes": [
    352
  ],
  "cvss_score": 8.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 46.98213741666667,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-11-10T13:25:03+00:00",
      "days": -0.5096191878703704,
      "is_lower_bound": true,
      "measured_at": "2026-11-11T01:38:54.150003+00:00",
      "url": "https://github.com/opf/openproject/security/advisories/GHSA-pggp-67cq-xgrg"
    }
  }
}