CVE-2026-23646

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23646", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-14T16:08:37.484Z", "datePublished": "2026-01-19T17:48:03.082Z", "dateUpdated": "2026-01-20T14:54:40.162Z"}, "containers": {"cna": {"title": "OpenProject users can delete other user's session, causing them to be logged out", "problemTypes": [{"descriptions": [{"cweId": "CWE-488", "lang": "en", "description": "CWE-488: Exposure of Data Element to Wrong Session", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/opf/openproject/security/advisories/GHSA-w422-xf8f-v4vp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/opf/openproject/security/advisories/GHSA-w422-xf8f-v4vp"}, {"name": "https://github.com/opf/openproject/releases/tag/v16.6.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/opf/openproject/releases/tag/v16.6.5"}, {"name": "https://github.com/opf/openproject/releases/tag/v17.0.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/opf/openproject/releases/tag/v17.0.1"}], "affected": [{"vendor": "opf", "product": "openproject", "versions": [{"version": "< 16.6.5", "status": "affected"}, {"version": "= 17.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-19T17:48:03.082Z"}, "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. Users of OpenProject versions prior to 16.6.5 and 17.0.1 have the ability to view and end their active sessions via Account Settings \u2192 Sessions. When deleting a session, it was not properly checked if the session belongs to the user. As the ID that is used to identify these session objects use incremental integers, users could iterate requests using `DELETE /my/sessions/:id` and thus unauthenticate other users. Users did not have access to any sensitive information (like browser identifier, IP addresses, etc) of other users that are stored in the session. The problem was patched in OpenProject versions 16.6.5 and 17.0.1. No known workarounds are available as this does not require any permissions or other that can temporarily be disabled."}], "source": {"advisory": "GHSA-w422-xf8f-v4vp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T14:54:33.443866Z", "id": "CVE-2026-23646", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T14:54:40.162Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23646", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T14:54:33.443866Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T14:54:36.799Z"}}], "cna": {"title": "OpenProject users can delete other user's session, causing them to be logged out", "source": {"advisory": "GHSA-w422-xf8f-v4vp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "opf", "product": "openproject", "versions": [{"status": "affected", "version": "< 16.6.5"}, {"status": "affected", "version": "= 17.0.0"}]}], "references": [{"url": "https://github.com/opf/openproject/security/advisories/GHSA-w422-xf8f-v4vp", "name": "https://github.com/opf/openproject/security/advisories/GHSA-w422-xf8f-v4vp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/opf/openproject/releases/tag/v16.6.5", "name": "https://github.com/opf/openproject/releases/tag/v16.6.5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/opf/openproject/releases/tag/v17.0.1", "name": "https://github.com/opf/openproject/releases/tag/v17.0.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. Users of OpenProject versions prior to 16.6.5 and 17.0.1 have the ability to view and end their active sessions via Account Settings \u2192 Sessions. When deleting a session, it was not properly checked if the session belongs to the user. As the ID that is used to identify these session objects use incremental integers, users could iterate requests using `DELETE /my/sessions/:id` and thus unauthenticate other users. Users did not have access to any sensitive information (like browser identifier, IP addresses, etc) of other users that are stored in the session. The problem was patched in OpenProject versions 16.6.5 and 17.0.1. No known workarounds are available as this does not require any permissions or other that can temporarily be disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-488", "description": "CWE-488: Exposure of Data Element to Wrong Session"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-19T17:48:03.082Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23646", "state": "PUBLISHED", "dateUpdated": "2026-01-20T14:54:40.162Z", "dateReserved": "2026-01-14T16:08:37.484Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-19T17:48:03.082Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openproject", "vendor": "opf", "versions": [{"status": "affected", "version": "< 16.6.5"}, {"status": "affected", "version": "= 17.0.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*", "matchCriteriaId": "4C6FE059-AB36-4883-AE55-2E65FDE51BD2", "versionEndExcluding": "16.6.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:openproject:openproject:17.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "78FA3834-A1AB-4489-AE2A-2C7FAE9B619F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. Users of OpenProject versions prior to 16.6.5 and 17.0.1 have the ability to view and end their active sessions via Account Settings \u2192 Sessions. When deleting a session, it was not properly checked if the session belongs to the user. As the ID that is used to identify these session objects use incremental integers, users could iterate requests using `DELETE /my/sessions/:id` and thus unauthenticate other users. Users did not have access to any sensitive information (like browser identifier, IP addresses, etc) of other users that are stored in the session. The problem was patched in OpenProject versions 16.6.5 and 17.0.1. No known workarounds are available as this does not require any permissions or other that can temporarily be disabled."}, {"lang": "es", "value": "OpenProject es un software de gesti\u00f3n de proyectos de c\u00f3digo abierto y basado en la web. Los usuarios de versiones de OpenProject anteriores a la 16.6.5 y 17.0.1 tienen la capacidad de ver y finalizar sus sesiones activas a trav\u00e9s de Configuraci\u00f3n de la cuenta ? Sesiones. Al eliminar una sesi\u00f3n, no se verificaba correctamente si la sesi\u00f3n pertenec\u00eda al usuario. Dado que el ID que se utiliza para identificar estos objetos de sesi\u00f3n usa enteros incrementales, los usuarios pod\u00edan iterar solicitudes usando 'DELETE /my/sessions/:id' y as\u00ed desautenticar a otros usuarios. Los usuarios no ten\u00edan acceso a ninguna informaci\u00f3n sensible (como identificador de navegador, direcciones IP, etc.) de otros usuarios que se almacena en la sesi\u00f3n. El problema fue parcheado en las versiones de OpenProject 16.6.5 y 17.0.1. No hay soluciones alternativas conocidas disponibles ya que esto no requiere ning\u00fan permiso u otro que pueda deshabilitarse temporalmente."}], "id": "CVE-2026-23646", "lastModified": "2026-06-17T10:21:53.210", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23646", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T14:54:33.443866Z", "version": "2.0.3"}}]}, "published": "2026-01-19T18:16:05.587", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/opf/openproject/releases/tag/v16.6.5"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/opf/openproject/releases/tag/v17.0.1"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/opf/openproject/security/advisories/GHSA-w422-xf8f-v4vp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-488"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T15:52:05.939400+00:00", "value": {"mitigation_remediation": ["upgrade OpenProject to version 16.6.5 or newer in the 16.x line, or to 17.0.1 or newer in the 17.x line", "ensure that the session deletion API enforce ownership checks or restrict DELETE /my/sessions/:id to the session owner only", "implement monitoring of session deletion activity to detect any anomalous or non\u2011owner requests"], "summary": {"action": "Patch Immediately", "impact": "Denial of Service via unintended session termination"}, "threat_synthesis": {"affected_systems": "The issue affects OpenProject versions released before 16.6.5 and 17.0.1. Customers running any earlier release of OpenProject should verify that their installation does not contain the buggy delete session endpoint.", "description_and_impact": "OpenProject allows authenticated users to terminate sessions of others due to a missing ownership check on the session delete endpoint. The deletion is performed by sending DELETE /my/sessions/:id requests where the :id value is a simple integer. Although no sensitive data such as IP or browser identifier is exposed, the ability to forcibly log out another user can disrupt work and impair collaborative processes. This flaw is a classic example of improper authorization leading to Denial of Service for legitimate users.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 6.5 and an EPSS score of less than 1%, indicating a moderate severity but a very low probability of current exploitation. It is not listed in the CISA KEV catalog. Based on the description, the attack vector is local: an attacker must first authenticate to the web application. Once authenticated, the attacker can iterate numeric session IDs and send delete requests, force\u2011logging out other users regardless of permission level. The flaw requires no elevated privileges and no additional conditions beyond a valid authenticated session."}}}}, "created": "2026-01-20T08:40:32.769317+00:00", "updated": "2026-04-18T16:00:04.285325+00:00", "vendors": ["openproject", "openproject$PRODUCT$openproject"]}