PT-2026-5179 · Openproject · Openproject

Syndrome-Impostor · Published 2026-01-28 · Updated 2026-02-12 · CVE-2026-24772

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenProject versions 17.0.0 through 17.0.1

Description OpenProject is a web-based project management software. A synchronization server was introduced in version 17.0.0 to enable real-time collaboration on documents. The server does not properly validate the backend URL and sends a request with a decrypted authentication token to the provided endpoint. This allows an attacker who has intercepted an authentication token to gain access to OpenProject on behalf of the victim. The authentication token is valid for 24 hours and is encrypted with a shared secret. The vulnerable functionality involves the interaction between the OpenProject backend, frontend, and synchronization server. The issue was introduced with version 17.0.0.

Recommendations Disable the collaboration feature via Settings -> Documents -> Real time collaboration -> Disable. Disable the hocuspocus container.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2026-24772

GHSA-R854-P5QJ-X974

Affected Products

Openproject

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24772.json · Exploit
• https://github.com/opf/openproject/security/advisories/GHSA-r854-p5qj-x974 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24772 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24772 · Security Note
• https://t.me/CVEtracker/43164 · Telegram Post
• https://twitter.com/pulsepatchio/status/2017249128057565329 · Twitter Post
• https://twitter.com/CveFindCom/status/2016605015473787249 · Twitter Post
• https://t.me/cveNotify/151883 · Telegram Post