CVE-2026-24772

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24772", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-26T21:06:47.868Z", "datePublished": "2026-01-28T18:07:02.278Z", "dateUpdated": "2026-01-28T18:31:44.037Z"}, "containers": {"cna": {"title": "OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server", "problemTypes": [{"descriptions": [{"cweId": "CWE-345", "lang": "en", "description": "CWE-345: Insufficient Verification of Data Authenticity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.9, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/opf/openproject/security/advisories/GHSA-r854-p5qj-x974", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/opf/openproject/security/advisories/GHSA-r854-p5qj-x974"}], "affected": [{"vendor": "opf", "product": "openproject", "versions": [{"version": "OpenProject >= 17.0.0, < 17.0.2", "status": "affected"}, {"version": "openproject/hocuspocus < 17.0.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-28T18:07:02.278Z"}, "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. To enable the real time collaboration on documents, OpenProject 17.0 introduced a synchronization server. The OpenPrioject backend generates an authentication token that is currently valid for 24 hours, encrypts it with a shared secret only known to the synchronization server. The frontend hands this encrypted token and the backend URL over to the synchronization server to check user's ability to work on the document and perform intermittent saves while editing. The synchronization server does not properly validate the backend URL and sends a request with the decrypted authentication token to the endpoint that was given to the server. An attacker could use this vulnerability to decrypt a token that he intercepted by other means to gain an access token to interact with OpenProject on the victim's behalf. This vulnerability was introduced with OpenProject 17.0.0 and was fixed in 17.0.2. As a workaround, disable the collaboration feature via Settings -> Documents -> Real time collaboration -> Disable. Additionally the `hocuspocus` container should also be disabled."}], "source": {"advisory": "GHSA-r854-p5qj-x974", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-28T18:31:30.415359Z", "id": "CVE-2026-24772", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T18:31:44.037Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24772", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-28T18:31:30.415359Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T18:31:32.581Z"}}], "cna": {"title": "OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server", "source": {"advisory": "GHSA-r854-p5qj-x974", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.9, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "opf", "product": "openproject", "versions": [{"status": "affected", "version": "OpenProject >= 17.0.0, < 17.0.2"}, {"status": "affected", "version": "openproject/hocuspocus < 17.0.2"}]}], "references": [{"url": "https://github.com/opf/openproject/security/advisories/GHSA-r854-p5qj-x974", "name": "https://github.com/opf/openproject/security/advisories/GHSA-r854-p5qj-x974", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. To enable the real time collaboration on documents, OpenProject 17.0 introduced a synchronization server. The OpenPrioject backend generates an authentication token that is currently valid for 24 hours, encrypts it with a shared secret only known to the synchronization server. The frontend hands this encrypted token and the backend URL over to the synchronization server to check user's ability to work on the document and perform intermittent saves while editing. The synchronization server does not properly validate the backend URL and sends a request with the decrypted authentication token to the endpoint that was given to the server. An attacker could use this vulnerability to decrypt a token that he intercepted by other means to gain an access token to interact with OpenProject on the victim's behalf. This vulnerability was introduced with OpenProject 17.0.0 and was fixed in 17.0.2. As a workaround, disable the collaboration feature via Settings -> Documents -> Real time collaboration -> Disable. Additionally the `hocuspocus` container should also be disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-345", "description": "CWE-345: Insufficient Verification of Data Authenticity"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-28T18:07:02.278Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24772", "state": "PUBLISHED", "dateUpdated": "2026-01-28T18:31:44.037Z", "dateReserved": "2026-01-26T21:06:47.868Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-28T18:07:02.278Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openproject", "vendor": "opf", "versions": [{"status": "affected", "version": "OpenProject >= 17.0.0, < 17.0.2"}, {"status": "affected", "version": "openproject/hocuspocus < 17.0.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*", "matchCriteriaId": "A4530571-3A78-40BB-9B33-880974D8C7CF", "versionEndExcluding": "17.0.2", "versionStartIncluding": "17.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. To enable the real time collaboration on documents, OpenProject 17.0 introduced a synchronization server. The OpenPrioject backend generates an authentication token that is currently valid for 24 hours, encrypts it with a shared secret only known to the synchronization server. The frontend hands this encrypted token and the backend URL over to the synchronization server to check user's ability to work on the document and perform intermittent saves while editing. The synchronization server does not properly validate the backend URL and sends a request with the decrypted authentication token to the endpoint that was given to the server. An attacker could use this vulnerability to decrypt a token that he intercepted by other means to gain an access token to interact with OpenProject on the victim's behalf. This vulnerability was introduced with OpenProject 17.0.0 and was fixed in 17.0.2. As a workaround, disable the collaboration feature via Settings -> Documents -> Real time collaboration -> Disable. Additionally the `hocuspocus` container should also be disabled."}, {"lang": "es", "value": "OpenProject es un software de gesti\u00f3n de proyectos de c\u00f3digo abierto y basado en la web. Para habilitar la colaboraci\u00f3n en tiempo real en documentos, OpenProject 17.0 introdujo un servidor de sincronizaci\u00f3n. El backend de OpenProject genera un token de autenticaci\u00f3n que actualmente es v\u00e1lido por 24 horas, lo cifra con un secreto compartido conocido solo por el servidor de sincronizaci\u00f3n. El frontend entrega este token cifrado y la URL del backend al servidor de sincronizaci\u00f3n para verificar la capacidad del usuario para trabajar en el documento y realizar guardados intermitentes durante la edici\u00f3n. El servidor de sincronizaci\u00f3n no valida correctamente la URL del backend y env\u00eda una solicitud con el token de autenticaci\u00f3n descifrado al endpoint que se le dio al servidor. Un atacante podr\u00eda usar esta vulnerabilidad para descifrar un token que intercept\u00f3 por otros medios para obtener un token de acceso para interactuar con OpenProject en nombre de la v\u00edctima. Esta vulnerabilidad fue introducida con OpenProject 17.0.0 y fue corregida en 17.0.2. Como soluci\u00f3n alternativa, deshabilite la funci\u00f3n de colaboraci\u00f3n a trav\u00e9s de Configuraci\u00f3n -&gt; Documentos -&gt; Colaboraci\u00f3n en tiempo real -&gt; Deshabilitar. Adem\u00e1s, el contenedor 'hocuspocus' tambi\u00e9n deber\u00eda deshabilitarse."}], "id": "CVE-2026-24772", "lastModified": "2026-06-17T10:23:34.070", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.9, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24772", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-28T18:31:30.415359Z", "version": "2.0.3"}}]}, "published": "2026-01-28T19:16:24.763", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/opf/openproject/security/advisories/GHSA-r854-p5qj-x974"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-345"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T01:42:10.430917+00:00", "value": {"mitigation_remediation": ["Apply the vendor patch to upgrade OpenProject to version\u00a017.0.2 or later", "Disable real\u2011time collaboration in Settings \u2192 Documents \u2192 Real time collaboration \u2192 Disable", "Stop or restrict the hocuspocus synchronization container from accepting external requests"], "summary": {"action": "Immediate Patch", "impact": "Unauthorized access via server-side request forgery"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in OpenProject 17.0.0 through 17.0.1. It is resolved in 17.0.2. Affected systems are installations of the OpenProject web application and the accompanying Hocuspocus synchronization container that are configured to enable real\u2011time collaboration.", "description_and_impact": "OpenProject\u2019s synchronization server in version\u00a017.0.0 introduced an endpoint that accepts a user\u2011supplied backend URL without proper validation. When a client sends a request containing an encrypted authentication token, the server decrypts the token and forwards the request to the supplied URL. An attacker who can obtain an intercepted token can exploit this flaw to cause the synchronization server to decrypt the token and obtain a valid access token, effectively allowing the attacker to act on the victim\u2019s behalf. This flaw represents a CWE\u2011345 server\u2011side request forgery and can lead to unauthorized account access and potential data leakage.", "risk_and_exploitability": "The CVSS score of\u00a08.9 indicates high severity, but the EPSS score is less than\u00a01\u202f%, suggesting a low likelihood of exploitation. The vulnerability is not listed in CISA\u2019s KEV catalog. Attackers would first need a way to obtain or guess a token, either by interception or phishing. Once the token is available, the flaw allows the server to decrypt it and use the resulting access token against the target OpenProject instance. Based on the description, the likely attack vector involves an authenticated but unauthorized user or a malicious party that can manipulate the backend URL parameter. This defers the need for higher privileges on the target system, making the exploit relatively straightforward for attackers who can gather a token."}}}}, "created": "2026-01-29T09:08:48.026869+00:00", "updated": "2026-04-18T01:45:33.403351+00:00", "vendors": ["openproject", "openproject$PRODUCT$openproject"]}