CVE-2019-11600: OpenProject activities API SQL injection via id parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote SQL injection with a high CVSS score, public exploit references and very high EPSS, though exploitation requires the instance to permit unauthenticated API access.

What it is

OpenProject before 8.3.2 contains a SQL injection flaw in the activities API, reachable through the id parameter. An attacker can inject arbitrary SQL commands, and the attack can be performed unauthenticated when the instance is configured to allow API access without authentication. This matters because it exposes the backend database to direct manipulation or extraction.

Impact

An attacker gains the ability to execute arbitrary SQL against the OpenProject database, enabling data theft, modification or deletion, and potentially further compromise depending on database privileges.

Attack surface

Reached remotely over the network through the activities API endpoint using the id parameter. No user interaction is required; authentication is not needed if the instance is configured for unauthenticated API access, though the CVSS vector rates attack complexity as high.

Exploitation

Not listed in CISA KEV, but EPSS is very high at roughly 0.80 (99.6th percentile) and multiple references are tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade OpenProject to 8.3.2 or later, which is the vendor-fixed release.
• If immediate upgrade is not possible, require authentication for all API access and restrict the activities API to trusted networks.
• Apply input validation or a WAF rule blocking SQL metacharacters in the id parameter of the activities API.
• Review database account privileges used by OpenProject and reduce them to the minimum needed.
• Audit logs for prior suspicious requests to the activities API endpoint.

Detection

• Monitor web and API logs for requests to the activities endpoint with SQL syntax or unexpected characters in the id parameter.
• Alert on database errors or unusual query patterns originating from the OpenProject application account.
• Hunt for anomalous data access or bulk reads from OpenProject-related database tables.
• Correlate outbound or lateral activity from the OpenProject host following suspicious API requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.