CVE-2026-22602

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22602", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-07T21:50:39.533Z", "datePublished": "2026-01-10T01:06:12.921Z", "dateUpdated": "2026-01-13T20:07:25.275Z"}, "containers": {"cna": {"title": "OpenProject is Vulnerable to User Enumeration via User ID", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/opf/openproject/security/advisories/GHSA-7fvx-9h6h-g82j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/opf/openproject/security/advisories/GHSA-7fvx-9h6h-g82j"}, {"name": "https://github.com/opf/openproject/pull/21281", "tags": ["x_refsource_MISC"], "url": "https://github.com/opf/openproject/pull/21281"}, {"name": "https://github.com/opf/openproject/commit/fb39a779f521d9b08f1e0c9e8aff2b6d4643ea37", "tags": ["x_refsource_MISC"], "url": "https://github.com/opf/openproject/commit/fb39a779f521d9b08f1e0c9e8aff2b6d4643ea37"}, {"name": "https://github.com/opf/openproject/releases/tag/v16.6.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/opf/openproject/releases/tag/v16.6.2"}], "affected": [{"vendor": "opf", "product": "openproject", "versions": [{"version": "< 16.6.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-10T01:06:12.921Z"}, "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, a low\u2011privileged logged-in user can view the full names of other users. Since user IDs are assigned sequentially and predictably (e.g., 1 to 1000), an attacker can extract a complete list of all users\u2019 full names by iterating through these URLs. The same behavior can also be reproduced via the OpenProject API, allowing automated retrieval of full names through the API as well. This issue has been patched in version 16.6.2. Those who are unable to upgrade may apply the patch manually."}], "source": {"advisory": "GHSA-7fvx-9h6h-g82j", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-13T20:07:17.982087Z", "id": "CVE-2026-22602", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T20:07:25.275Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22602", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-13T20:07:17.982087Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T20:07:22.747Z"}}], "cna": {"title": "OpenProject is Vulnerable to User Enumeration via User ID", "source": {"advisory": "GHSA-7fvx-9h6h-g82j", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "opf", "product": "openproject", "versions": [{"status": "affected", "version": "< 16.6.2"}]}], "references": [{"url": "https://github.com/opf/openproject/security/advisories/GHSA-7fvx-9h6h-g82j", "name": "https://github.com/opf/openproject/security/advisories/GHSA-7fvx-9h6h-g82j", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/opf/openproject/pull/21281", "name": "https://github.com/opf/openproject/pull/21281", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/opf/openproject/commit/fb39a779f521d9b08f1e0c9e8aff2b6d4643ea37", "name": "https://github.com/opf/openproject/commit/fb39a779f521d9b08f1e0c9e8aff2b6d4643ea37", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/opf/openproject/releases/tag/v16.6.2", "name": "https://github.com/opf/openproject/releases/tag/v16.6.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, a low\u2011privileged logged-in user can view the full names of other users. Since user IDs are assigned sequentially and predictably (e.g., 1 to 1000), an attacker can extract a complete list of all users\u2019 full names by iterating through these URLs. The same behavior can also be reproduced via the OpenProject API, allowing automated retrieval of full names through the API as well. This issue has been patched in version 16.6.2. Those who are unable to upgrade may apply the patch manually."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-10T01:06:12.921Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22602", "state": "PUBLISHED", "dateUpdated": "2026-01-13T20:07:25.275Z", "dateReserved": "2026-01-07T21:50:39.533Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-10T01:06:12.921Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openproject", "vendor": "opf", "versions": [{"status": "affected", "version": "< 16.6.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF8C07E6-1B04-4E9E-A12C-8CB0A17A95D5", "versionEndExcluding": "16.6.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, a low\u2011privileged logged-in user can view the full names of other users. Since user IDs are assigned sequentially and predictably (e.g., 1 to 1000), an attacker can extract a complete list of all users\u2019 full names by iterating through these URLs. The same behavior can also be reproduced via the OpenProject API, allowing automated retrieval of full names through the API as well. This issue has been patched in version 16.6.2. Those who are unable to upgrade may apply the patch manually."}, {"lang": "es", "value": "OpenProject es un software de gesti\u00f3n de proyectos de c\u00f3digo abierto y basado en la web. Antes de la versi\u00f3n 16.6.2, un usuario con pocos privilegios y con sesi\u00f3n iniciada puede ver los nombres completos de otros usuarios. Dado que los ID de usuario se asignan de forma secuencial y predecible (por ejemplo, del 1 al 1000), un atacante puede extraer una lista completa de los nombres completos de todos los usuarios al iterar a trav\u00e9s de estas URL. El mismo comportamiento tambi\u00e9n puede reproducirse a trav\u00e9s de la API de OpenProject, permitiendo la recuperaci\u00f3n automatizada de nombres completos tambi\u00e9n a trav\u00e9s de la API. Este problema ha sido parcheado en la versi\u00f3n 16.6.2. Aquellos que no puedan actualizar pueden aplicar el parche manualmente."}], "id": "CVE-2026-22602", "lastModified": "2026-06-17T10:20:08.657", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22602", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-13T20:07:17.982087Z", "version": "2.0.3"}}]}, "published": "2026-01-10T02:15:49.057", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/opf/openproject/commit/fb39a779f521d9b08f1e0c9e8aff2b6d4643ea37"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/opf/openproject/pull/21281"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/opf/openproject/releases/tag/v16.6.2"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/opf/openproject/security/advisories/GHSA-7fvx-9h6h-g82j"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T07:17:44.623969+00:00", "value": {"mitigation_remediation": ["Upgrade OpenProject to version\u202f16.6.2 or newer where the enumeration issue is fixed.", "If an upgrade is not possible, apply the manual patch referenced in the security advisory to restrict or randomize user ID exposure.", "Disable or restrict direct user ID access in web routes and API endpoints, or enforce stricter access controls so that only administrators can view full names."], "summary": {"action": "Patch", "impact": "User Enumeration via User ID"}, "threat_synthesis": {"affected_systems": "The flaw affects all installations of OpenProject released before version\u202f16.6.2. Those running the open\u2011source web\u2011based project management software at any environment\u2014on\u2011premises or hosted\u2014are susceptible if they have not applied the fix. The patch is bundled in the v16.6.2 release and is also available as a manual patch for environments that cannot upgrade immediately.", "description_and_impact": "A low\u2011privileged logged\u2011in user can view the full names of other users. Because the system assigns user IDs sequentially, an attacker can iterate through numerical URLs or API endpoints to enumerate every user. This results in an information disclosure weakness (CWE\u2011200) that reveals full names to anyone with a basic account, potentially compromising personal privacy within the organization.", "risk_and_exploitability": "The CVSS base score is 3.5, indicating low severity, and the EPSS score is less than 1\u202f%, suggesting limited current exploitation likelihood. The vulnerability is not listed in CISA\u2019s KEV catalog. An attacker who is authenticated as a low\u2011privilege user can enumerate all other users by sending repeated requests to predictable URLs or API calls, enabling automated harvesting of personal data."}}}}, "created": "2026-01-12T14:36:47.806997+00:00", "updated": "2026-04-18T07:30:36.021121+00:00", "vendors": ["openproject", "openproject$PRODUCT$openproject"]}