PT-2026-3465 · Unknown · Openproject

Syndrome-Impostor · Publicado 2026-01-19 · Atualizado 2026-02-02 · CVE-2026-23646

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 16.6.5 OpenProject versions prior to 17.0.1

Description OpenProject is a web-based project management software. Users of affected versions could potentially unauthenticate other users by iterating requests to the DELETE /my/sessions/:id API endpoint with manipulated session IDs (id). This occurred because the system did not properly verify if a session belonged to the user attempting to delete it. While users could not access sensitive information like browser identifiers or IP addresses, they could terminate other users' active sessions.

Recommendations Update OpenProject to version 16.6.5 or later. Update OpenProject to version 17.0.1 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-488

Identificadores relacionados

CVE-2026-23646

GHSA-W422-XF8F-V4VP

Produtos afetados

Openproject

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23646.json · Exploit
• https://github.com/opf/openproject/security/advisories/GHSA-w422-xf8f-v4vp · Aviso do Fabricante
• https://github.com/opf/openproject/releases/tag/v16.6.5 · Nota
• https://github.com/opf/openproject/releases/tag/v17.0.1 · Nota
• https://osv.dev/vulnerability/CVE-2026-23646 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2013316913091223807 · Publicação no Twitter
• https://t.me/cveNotify/150644 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-23646 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2013352466733998203 · Publicação no Twitter