PT-2026-3474 · Unknown · Openproject

Trongdaong24 · Publicado 2026-01-19 · Atualizado 2026-02-02 · CVE-2026-23721

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.0.1 OpenProject versions prior to 16.6.5

Description OpenProject is a web-based project management software. A permission check failure in earlier versions allowed users with the 'View Members' permission in any project to list all groups and identify all members within those groups, bypassing intended access restrictions. The issue affects group member visibility within the application.

Recommendations Update to OpenProject version 17.0.1 or later. Update to OpenProject version 16.6.5 or later.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-23721

GHSA-VJ77-WRC2-5H5H

Produtos afetados

Openproject

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23721.json · Exploit
• https://github.com/opf/openproject/security/advisories/GHSA-vj77-wrc2-5h5h · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-23721 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-23721 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2013347347019731333 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2013316911136657430 · Publicação no Twitter
• https://t.me/cveNotify/150645 · Publicação no Telegram