CVE-2026-22604

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22604", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-07T21:50:39.533Z", "datePublished": "2026-01-10T01:07:02.555Z", "dateUpdated": "2026-01-12T19:16:12.780Z"}, "containers": {"cna": {"title": "OpenProject is vulnerable to user enumeration via the change password function", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/opf/openproject/security/advisories/GHSA-q7qp-p3vw-j2fh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/opf/openproject/security/advisories/GHSA-q7qp-p3vw-j2fh"}, {"name": "https://github.com/opf/openproject/pull/3451", "tags": ["x_refsource_MISC"], "url": "https://github.com/opf/openproject/pull/3451"}, {"name": "https://github.com/opf/openproject/commit/2cff5e98649e32a197a62659a23dd4b864b7855b", "tags": ["x_refsource_MISC"], "url": "https://github.com/opf/openproject/commit/2cff5e98649e32a197a62659a23dd4b864b7855b"}, {"name": "https://github.com/opf/openproject/releases/tag/v16.6.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/opf/openproject/releases/tag/v16.6.2"}], "affected": [{"vendor": "opf", "product": "openproject", "versions": [{"version": ">= 11.2.1, < 16.6.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-10T01:07:02.555Z"}, "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. For OpenProject versions from 11.2.1 to before 16.6.2, when sending a POST request to the /account/change_password endpoint with an arbitrary User ID as the password_change_user_id parameter, the resulting error page would show the username for the requested user. Since this endpoint is intended to be called without being authenticated, this allows to enumerate the user names of all accounts registered in an OpenProject instance. This issue has been patched in version 16.6.2."}], "source": {"advisory": "GHSA-q7qp-p3vw-j2fh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-12T19:16:07.332579Z", "id": "CVE-2026-22604", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-12T19:16:12.780Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22604", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-12T19:16:07.332579Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-12T19:16:10.309Z"}}], "cna": {"title": "OpenProject is vulnerable to user enumeration via the change password function", "source": {"advisory": "GHSA-q7qp-p3vw-j2fh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "opf", "product": "openproject", "versions": [{"status": "affected", "version": ">= 11.2.1, < 16.6.2"}]}], "references": [{"url": "https://github.com/opf/openproject/security/advisories/GHSA-q7qp-p3vw-j2fh", "name": "https://github.com/opf/openproject/security/advisories/GHSA-q7qp-p3vw-j2fh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/opf/openproject/pull/3451", "name": "https://github.com/opf/openproject/pull/3451", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/opf/openproject/commit/2cff5e98649e32a197a62659a23dd4b864b7855b", "name": "https://github.com/opf/openproject/commit/2cff5e98649e32a197a62659a23dd4b864b7855b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/opf/openproject/releases/tag/v16.6.2", "name": "https://github.com/opf/openproject/releases/tag/v16.6.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. For OpenProject versions from 11.2.1 to before 16.6.2, when sending a POST request to the /account/change_password endpoint with an arbitrary User ID as the password_change_user_id parameter, the resulting error page would show the username for the requested user. Since this endpoint is intended to be called without being authenticated, this allows to enumerate the user names of all accounts registered in an OpenProject instance. This issue has been patched in version 16.6.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-10T01:07:02.555Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22604", "state": "PUBLISHED", "dateUpdated": "2026-01-12T19:16:12.780Z", "dateReserved": "2026-01-07T21:50:39.533Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-10T01:07:02.555Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openproject", "vendor": "opf", "versions": [{"status": "affected", "version": ">= 11.2.1, < 16.6.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*", "matchCriteriaId": "2307C060-CCE8-426E-B5C5-BD80528E4335", "versionEndExcluding": "16.6.2", "versionStartIncluding": "11.2.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. For OpenProject versions from 11.2.1 to before 16.6.2, when sending a POST request to the /account/change_password endpoint with an arbitrary User ID as the password_change_user_id parameter, the resulting error page would show the username for the requested user. Since this endpoint is intended to be called without being authenticated, this allows to enumerate the user names of all accounts registered in an OpenProject instance. This issue has been patched in version 16.6.2."}, {"lang": "es", "value": "OpenProject es un software de gesti\u00f3n de proyectos de c\u00f3digo abierto y basado en web. Para las versiones de OpenProject desde la 11.2.1 hasta antes de la 16.6.2, al enviar una solicitud POST al endpoint /account/change_password con un ID de usuario arbitrario como par\u00e1metro password_change_user_id, la p\u00e1gina de error resultante mostrar\u00eda el nombre de usuario del usuario solicitado. Dado que este endpoint est\u00e1 dise\u00f1ado para ser llamado sin autenticaci\u00f3n, esto permite enumerar los nombres de usuario de todas las cuentas registradas en una instancia de OpenProject. Este problema ha sido parcheado en la versi\u00f3n 16.6.2."}], "id": "CVE-2026-22604", "lastModified": "2026-06-17T10:20:08.880", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22604", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-12T19:16:07.332579Z", "version": "2.0.3"}}]}, "published": "2026-01-10T02:15:49.343", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/opf/openproject/commit/2cff5e98649e32a197a62659a23dd4b864b7855b"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/opf/openproject/pull/3451"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/opf/openproject/releases/tag/v16.6.2"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/opf/openproject/security/advisories/GHSA-q7qp-p3vw-j2fh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T07:17:04.807581+00:00", "value": {"mitigation_remediation": ["Upgrade OpenProject to version 16.6.2 or later, which removes the disclosure of usernames from error messages.", "If an upgrade is not immediately possible, restrict unauthenticated access to the /account/change_password endpoint using web\u2011application firewalls or network controls so that only legitimate account\u2011recall traffic can reach it.", "Monitor access logs for repeated POST attempts to /account/change_password that include arbitrary user ID parameters, as these may indicate enumeration activity."], "summary": {"action": "Patch Now", "impact": "User Enumeration via Unauthenticated Endpoint"}, "threat_synthesis": {"affected_systems": "OpenProject versions from 11.2.1 up to (but not including) 16.6.2 are affected. The software vendor is OpenProject, and the public package is the OpenProject web application.", "description_and_impact": "An error response from the /account/change_password endpoint reveals the username of any user when an arbitrary user ID is supplied, even when the requester is not authenticated. The flaw arises because the endpoint is intended for unauthenticated use but does not sanitize or mask error information. This allows an attacker to discover all account usernames on an OpenProject instance, which can be leveraged for targeted phishing, credential stuffing, or further attacks that require knowledge of valid identities. The weakness is a classic information disclosure scenario, mapped to CWE\u2011200.", "risk_and_exploitability": "The CVSS score of 6.9 indicates moderate severity. The EPSS score is less than 1%, suggesting that, at the time of this analysis, the likelihood of exploitation in the wild is low. The vulnerability is not listed in CISA\u2019s Known Exploited Vulnerabilities catalog, and no widely publicized exploits are known. Exploitation requires only a simple HTTP POST request without authentication, making the attack vector easy to construct. An attacker with network access to the OpenProject instance can enumerate usernames by iterating through user IDs, despite there being no authenticated session required. The impact is primarily privacy and future attack facilitation rather than immediate compromise of code or data integrity."}}}}, "created": "2026-01-12T14:36:56.949671+00:00", "updated": "2026-04-18T07:30:36.020485+00:00", "vendors": ["openproject", "openproject$PRODUCT$openproject"]}