PT-2026-5179 · Openproject · Openproject

Syndrome-Impostor · Publicado 2026-01-28 · Atualizado 2026-02-12 · CVE-2026-24772

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenProject versions 17.0.0 through 17.0.1

Description OpenProject is a web-based project management software. A synchronization server was introduced in version 17.0.0 to enable real-time collaboration on documents. The server does not properly validate the backend URL and sends a request with a decrypted authentication token to the provided endpoint. This allows an attacker who has intercepted an authentication token to gain access to OpenProject on behalf of the victim. The authentication token is valid for 24 hours and is encrypted with a shared secret. The vulnerable functionality involves the interaction between the OpenProject backend, frontend, and synchronization server. The issue was introduced with version 17.0.0.

Recommendations Disable the collaboration feature via Settings -> Documents -> Real time collaboration -> Disable. Disable the hocuspocus container.

Exploit

Correção

Insufficient Verification of Data Authenticity

Enumeração de Fraquezas

CWE-345

Identificadores relacionados

CVE-2026-24772

GHSA-R854-P5QJ-X974

Produtos afetados

Openproject

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24772.json · Exploit
• https://github.com/opf/openproject/security/advisories/GHSA-r854-p5qj-x974 · Aviso do Fabricante
• https://t.me/CVEtracker/43164 · Publicação no Telegram
• https://twitter.com/pulsepatchio/status/2017249128057565329 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-24772 · Aviso do Fabricante
• https://twitter.com/CveFindCom/status/2016605015473787249 · Publicação no Twitter
• https://t.me/cveNotify/151883 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-24772 · Nota de Segurança