CVE-2026-44733
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In OpenProject prior to versions 17.3.2 and 17.4.0, a business logic error in the password change mechanism allows bypassing password strength requirements via a PATCH request to /api/v3/users/me. An attacker with an active session takeover can change a user's password to a weak one.
Risk Assessment
The risk is that an attacker who has taken over an active session can set a weak password, facilitating further unauthorized access to the account and potentially to sensitive project data.
Recommendation
Immediately update OpenProject to version 17.3.2 or 17.4.0, which fixes this vulnerability. After updating, consider forcing all users to change their passwords.
Other vulnerabilities in OpenProject
See all- CVE-2026-22601High
OpenProject is an open-source, web-based project management software. In version 16.6.1 and below, a registered administrator can execute arbitrary commands by configuring the sendmail binary path and sending a test email. This issue has been patched in version 16.6.2.
- CVE-2017-11667High
OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, allowing remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session.
- CVE-2026-52785Critical
OpenProject before versions 17.3.3 and 17.4.1 contains a SQL injection vulnerability in the timestamps functionality. Attackers can exploit the timestamps parameter to execute unauthorized database queries.
- CVE-2026-52782Critical
In OpenProject prior to versions 17.3.3 and 17.4.1, an IDOR vulnerability exists in the endpoint /projects/<A>/settings/project_storages/<A_ps_id> via the PATCH parameter "storages_project_storage[project_folder_id]". A project administrator can hijack the managed Nextcloud or OneDrive folder of another project on the same storage, leading to unauthorized resource access.
- CVE-2026-46386Critical
The official openproject/openproject Docker image ships with a default SECRET_KEY_BASE=OVERWRITE_ME, which combined with cookies_serializer = :marshal allows any logged-in user a deterministic Marshal-deserialization path via the /my/two_factor_devices cookie reader. This vulnerability is fixed in a later version.
- CVE-2026-34717Critical
OpenProject prior to version 17.2.3 has an SQL injection vulnerability in the =n operator in modules/reporting/lib/report/operator.rb:177. This operator embeds user input directly into SQL WHERE clauses without parameterization.
- CVE-2026-22600Critical
OpenProject before version 16.6.4 contains a Local File Read vulnerability in the work package PDF export. By uploading a specially crafted SVG file (disguised as PNG) as an attachment, an attacker can exploit the ImageMagick engine to read arbitrary local files accessible to the application user.
- CVE-2026-55095Medium
OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw custom_field_ project attribute. The dialog path resolves the project custom field by its raw identifier without enforcing the normal admin_only visibility scope and renders the stored custom-field comment in read-only mode. This discloses hidden comment text but does not disclose the custom-field value or permit writes or mutation. This issue is reported as fixed in version 17.6.0.
- CVE-2026-67529Medium
OpenProject before 17.6.0 in GET /api/v3/time_entries and GET /api/v3/cost_entries exposed private work package titles and IDs without visibility checks. Users with view_time_entries or view_cost_entries could read this data.
- CVE-2026-67528Medium
OpenProject before 17.6.0 in GET /api/v3/custom_options/:id resolved custom options by global numeric ID without visibility checks. Authenticated non-admin users could enumerate IDs and read labels of admin-only options.
Original NVD description (English source)
OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass password requirements. A password validation flaw in the change password behavior allows attackers to change a user's password only with an active session takeover. This vulnerability is fixed in 17.3.2 and 17.4.0.