PT-2026-3465 · Unknown · Openproject

Syndrome-Impostor · Published 2026-01-19 · Updated 2026-02-02 · CVE-2026-23646

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 16.6.5 OpenProject versions prior to 17.0.1

Description OpenProject is a web-based project management software. Users of affected versions could potentially unauthenticate other users by iterating requests to the DELETE /my/sessions/:id API endpoint with manipulated session IDs (id). This occurred because the system did not properly verify if a session belonged to the user attempting to delete it. While users could not access sensitive information like browser identifiers or IP addresses, they could terminate other users' active sessions.

Recommendations Update OpenProject to version 16.6.5 or later. Update OpenProject to version 17.0.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-488

Related Identifiers

CVE-2026-23646

GHSA-W422-XF8F-V4VP

Affected Products

Openproject

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23646.json · Exploit
• https://github.com/opf/openproject/security/advisories/GHSA-w422-xf8f-v4vp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23646 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23646 · Security Note
• https://github.com/opf/openproject/releases/tag/v16.6.5 · Note
• https://github.com/opf/openproject/releases/tag/v17.0.1 · Note
• https://twitter.com/CVEnew/status/2013316913091223807 · Twitter Post
• https://t.me/cveNotify/150644 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2013352466733998203 · Twitter Post