PT-2026-2224 · Openproject · Openproject

Oliverguenther · Published 2026-01-10 · Updated 2026-01-12 · CVE-2026-22604

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenProject versions 11.2.1 through 16.6.1

Description OpenProject is a web-based project management software. A flaw exists where sending a POST request to the /account/change password API endpoint with an arbitrary User ID specified in the password change user id parameter can reveal the username associated with that ID. This occurs because the endpoint does not require authentication, allowing for the enumeration of usernames for all registered accounts within an OpenProject instance.

Recommendations OpenProject versions 11.2.1 through 16.6.1 should be updated to version 16.6.2 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-22604

GHSA-Q7QP-P3VW-J2FH

Affected Products

Openproject

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22604.json · Exploit
• https://github.com/opf/openproject/commit/2cff5e98649e32a197a62659a23dd4b864b7855b · Patch
• https://github.com/opf/openproject/security/advisories/GHSA-q7qp-p3vw-j2fh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22604 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22604 · Security Note
• https://github.com/opf/openproject/releases/tag/v16.6.2 · Note
• https://github.com/opf/openproject/pull/3451 · Note
• https://t.me/CVEtracker/41900 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2009948633001505063 · Twitter Post
• https://twitter.com/MantodeaSec/status/2010751620565647557 · Twitter Post
• https://twitter.com/CVEnew/status/2009846293003378942 · Twitter Post