CVE-2026-22603

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22603", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-07T21:50:39.533Z", "datePublished": "2026-01-10T01:06:28.742Z", "dateUpdated": "2026-01-13T19:59:34.458Z"}, "containers": {"cna": {"title": "OpenProject has no protection against brute-force attacks in the Change Password function", "problemTypes": [{"descriptions": [{"cweId": "CWE-307", "lang": "en", "description": "CWE-307: Improper Restriction of Excessive Authentication Attempts", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/opf/openproject/security/advisories/GHSA-93x5-prx9-x239", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/opf/openproject/security/advisories/GHSA-93x5-prx9-x239"}, {"name": "https://github.com/opf/openproject/pull/21272", "tags": ["x_refsource_MISC"], "url": "https://github.com/opf/openproject/pull/21272"}, {"name": "https://github.com/opf/openproject/commit/2b394b9ba5af1e5d96a64d7d452d4d44598a4c7f", "tags": ["x_refsource_MISC"], "url": "https://github.com/opf/openproject/commit/2b394b9ba5af1e5d96a64d7d452d4d44598a4c7f"}, {"name": "https://github.com/opf/openproject/releases/tag/v16.6.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/opf/openproject/releases/tag/v16.6.2"}], "affected": [{"vendor": "opf", "product": "openproject", "versions": [{"version": "< 16.6.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-10T01:06:28.742Z"}, "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, OpenProject\u2019s unauthenticated password-change endpoint (/account/change_password) was not protected by the same brute-force safeguards that apply to the normal login form. In affected versions, an attacker who can guess or enumerate user IDs can send unlimited password-change requests for a given account without triggering lockout or other rate-limiting controls. This allows automated password-guessing (e.g., with wordlists of common passwords) against valid accounts. Successful guessing results in full account compromise for the targeted user and, depending on that user\u2019s role, can lead to further privilege escalation inside the application. This issue has been patched in version 16.6.2. Those who are unable to upgrade may apply the patch manually."}], "source": {"advisory": "GHSA-93x5-prx9-x239", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-13T19:59:25.864424Z", "id": "CVE-2026-22603", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T19:59:34.458Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22603", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-13T19:59:25.864424Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T19:59:30.897Z"}}], "cna": {"title": "OpenProject has no protection against brute-force attacks in the Change Password function", "source": {"advisory": "GHSA-93x5-prx9-x239", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "opf", "product": "openproject", "versions": [{"status": "affected", "version": "< 16.6.2"}]}], "references": [{"url": "https://github.com/opf/openproject/security/advisories/GHSA-93x5-prx9-x239", "name": "https://github.com/opf/openproject/security/advisories/GHSA-93x5-prx9-x239", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/opf/openproject/pull/21272", "name": "https://github.com/opf/openproject/pull/21272", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/opf/openproject/commit/2b394b9ba5af1e5d96a64d7d452d4d44598a4c7f", "name": "https://github.com/opf/openproject/commit/2b394b9ba5af1e5d96a64d7d452d4d44598a4c7f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/opf/openproject/releases/tag/v16.6.2", "name": "https://github.com/opf/openproject/releases/tag/v16.6.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, OpenProject\u2019s unauthenticated password-change endpoint (/account/change_password) was not protected by the same brute-force safeguards that apply to the normal login form. In affected versions, an attacker who can guess or enumerate user IDs can send unlimited password-change requests for a given account without triggering lockout or other rate-limiting controls. This allows automated password-guessing (e.g., with wordlists of common passwords) against valid accounts. Successful guessing results in full account compromise for the targeted user and, depending on that user\u2019s role, can lead to further privilege escalation inside the application. This issue has been patched in version 16.6.2. Those who are unable to upgrade may apply the patch manually."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-307", "description": "CWE-307: Improper Restriction of Excessive Authentication Attempts"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-10T01:06:28.742Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22603", "state": "PUBLISHED", "dateUpdated": "2026-01-13T19:59:34.458Z", "dateReserved": "2026-01-07T21:50:39.533Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-10T01:06:28.742Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openproject", "vendor": "opf", "versions": [{"status": "affected", "version": "< 16.6.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF8C07E6-1B04-4E9E-A12C-8CB0A17A95D5", "versionEndExcluding": "16.6.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, OpenProject\u2019s unauthenticated password-change endpoint (/account/change_password) was not protected by the same brute-force safeguards that apply to the normal login form. In affected versions, an attacker who can guess or enumerate user IDs can send unlimited password-change requests for a given account without triggering lockout or other rate-limiting controls. This allows automated password-guessing (e.g., with wordlists of common passwords) against valid accounts. Successful guessing results in full account compromise for the targeted user and, depending on that user\u2019s role, can lead to further privilege escalation inside the application. This issue has been patched in version 16.6.2. Those who are unable to upgrade may apply the patch manually."}, {"lang": "es", "value": "OpenProject es un software de gesti\u00f3n de proyectos de c\u00f3digo abierto y basado en la web. Antes de la versi\u00f3n 16.6.2, el endpoint de cambio de contrase\u00f1a no autenticado de OpenProject (/account/change_password) no estaba protegido por las mismas salvaguardas contra fuerza bruta que se aplican al formulario de inicio de sesi\u00f3n normal. En las versiones afectadas, un atacante que puede adivinar o enumerar IDs de usuario puede enviar solicitudes ilimitadas de cambio de contrase\u00f1a para una cuenta determinada sin activar el bloqueo de cuenta u otros controles de limitaci\u00f3n de velocidad. Esto permite la adivinaci\u00f3n automatizada de contrase\u00f1as (por ejemplo, con listas de palabras de contrase\u00f1as comunes) contra cuentas v\u00e1lidas. La adivinaci\u00f3n exitosa resulta en el compromiso total de la cuenta para el usuario objetivo y, dependiendo del rol de ese usuario, puede conducir a una mayor escalada de privilegios dentro de la aplicaci\u00f3n. Este problema ha sido parcheado en la versi\u00f3n 16.6.2. Aquellos que no puedan actualizar pueden aplicar el parche manualmente."}], "id": "CVE-2026-22603", "lastModified": "2026-06-17T10:20:08.760", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22603", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-13T19:59:25.864424Z", "version": "2.0.3"}}]}, "published": "2026-01-10T02:15:49.200", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/opf/openproject/commit/2b394b9ba5af1e5d96a64d7d452d4d44598a4c7f"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/opf/openproject/pull/21272"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/opf/openproject/releases/tag/v16.6.2"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/opf/openproject/security/advisories/GHSA-93x5-prx9-x239"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-307"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T16:34:11.178969+00:00", "value": {"mitigation_remediation": ["Upgrade OpenProject to version\u202f16.6.2 or later. The package includes the fix that restores brute\u2011force protection to the password\u2011change endpoint.", "If an upgrade is not feasible, apply the manual patch as described in the advisory (commit\u202f2b394b9ba5af1e5d96a64d7d452d4d44598a4c7f) or merge the changes from pull request\u202f21272 to re\u2011implement the rate\u2011limiting logic.", "Deploy a reverse\u2011proxy or firewall rule to rate\u2011limit or block repeated requests to the /account/change_password endpoint until the fix is applied."], "summary": {"action": "Apply patch", "impact": "Account takeover and potential privilege escalation via unrestricted password\u2011reset brute\u2011force"}, "threat_synthesis": {"affected_systems": "The vulnerability affects OpenProject, an open\u2011source, web\u2011based project management system, in all releases prior to version\u202f16.6.2. Users of these older versions are at risk if the change\u2011password functionality is reachable without additional authentication or rate limiting.", "description_and_impact": "OpenProject\u2019s unauthenticated password\u2011change endpoint (/account/change_password) lacks the brute\u2011force protections that guard the normal login form. An attacker who can discover or guess a valid user identifier can submit unlimited password\u2011reset requests without triggering lockout or rate limits. Successful guessing of a user\u2019s password resets the account to the attacker\u2019s chosen value, resulting in full account compromise and, depending on the user\u2019s role, possible privilege escalation within the application. The weakness is identified as CWE\u2011307.", "risk_and_exploitability": "The public CVSS score is\u202f6.9, indicating a moderate severity, while the EPSS score is below\u202f1\u202f%, suggesting a low likelihood of exploitation at present. The issue is not yet listed in the CISA KEV catalog. However, the attack requires only the ability to enumerate user IDs and a low number of attempts to compromise accounts that use common passwords. Inferred from the description, the attack vector is an unauthenticated brute\u2011force request to the password\u2011change endpoint; the vulnerability can be exploited with no additional privileges and no network access beyond normal usage of the web application."}}}}, "created": "2026-01-12T14:36:51.159376+00:00", "updated": "2026-04-18T16:45:05.218332+00:00", "vendors": ["openproject", "openproject$PRODUCT$openproject"]}