CVE-2026-24777

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24777", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-26T21:06:47.869Z", "datePublished": "2026-02-09T18:28:45.146Z", "dateUpdated": "2026-02-09T19:14:26.197Z"}, "containers": {"cna": {"title": "OpenProject has Improper Access Control on User Management allows user managers to lock admin accounts", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/opf/openproject/security/advisories/GHSA-fq66-cwg6-qq69", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/opf/openproject/security/advisories/GHSA-fq66-cwg6-qq69"}, {"name": "https://github.com/opf/openproject/releases/tag/v17.0.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/opf/openproject/releases/tag/v17.0.2"}], "affected": [{"vendor": "opf", "product": "openproject", "versions": [{"version": "< 17.0.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-09T18:28:45.146Z"}, "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. Prior to 17.0.2, users with the Manage Users permission can lock and unlock users. This functionality should only be possible for users of the application, but they were not supposed to be able to lock application administrators. Due to a missing permission check this logic was not enforced. The problem was fixed in OpenProject 17.0.2The problem was fixed in OpenProject 17.0.2."}], "source": {"advisory": "GHSA-fq66-cwg6-qq69", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-09T19:14:16.807517Z", "id": "CVE-2026-24777", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T19:14:26.197Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24777", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-09T19:14:16.807517Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T19:14:21.379Z"}}], "cna": {"title": "OpenProject has Improper Access Control on User Management allows user managers to lock admin accounts", "source": {"advisory": "GHSA-fq66-cwg6-qq69", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "opf", "product": "openproject", "versions": [{"status": "affected", "version": "< 17.0.2"}]}], "references": [{"url": "https://github.com/opf/openproject/security/advisories/GHSA-fq66-cwg6-qq69", "name": "https://github.com/opf/openproject/security/advisories/GHSA-fq66-cwg6-qq69", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/opf/openproject/releases/tag/v17.0.2", "name": "https://github.com/opf/openproject/releases/tag/v17.0.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. Prior to 17.0.2, users with the Manage Users permission can lock and unlock users. This functionality should only be possible for users of the application, but they were not supposed to be able to lock application administrators. Due to a missing permission check this logic was not enforced. The problem was fixed in OpenProject 17.0.2The problem was fixed in OpenProject 17.0.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-09T18:28:45.146Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24777", "state": "PUBLISHED", "dateUpdated": "2026-02-09T19:14:26.197Z", "dateReserved": "2026-01-26T21:06:47.869Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-09T18:28:45.146Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openproject", "vendor": "opf", "versions": [{"status": "affected", "version": "< 17.0.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*", "matchCriteriaId": "3FA4C106-EEE3-4582-BE10-010975AE359B", "versionEndExcluding": "17.0.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. Prior to 17.0.2, users with the Manage Users permission can lock and unlock users. This functionality should only be possible for users of the application, but they were not supposed to be able to lock application administrators. Due to a missing permission check this logic was not enforced. The problem was fixed in OpenProject 17.0.2The problem was fixed in OpenProject 17.0.2."}, {"lang": "es", "value": "OpenProject es un software de gesti\u00f3n de proyectos de c\u00f3digo abierto y basado en la web. Antes de la versi\u00f3n 17.0.2, los usuarios con el permiso Gestionar Usuarios pod\u00edan bloquear y desbloquear usuarios. Esta funcionalidad solo deber\u00eda ser posible para los usuarios de la aplicaci\u00f3n, pero no se supon\u00eda que pudieran bloquear a los administradores de la aplicaci\u00f3n. Debido a una comprobaci\u00f3n de permisos faltante, esta l\u00f3gica no se aplic\u00f3. El problema se solucion\u00f3 en OpenProject 17.0.2."}], "id": "CVE-2026-24777", "lastModified": "2026-06-17T10:23:34.603", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24777", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-09T19:14:16.807517Z", "version": "2.0.3"}}]}, "published": "2026-02-09T19:15:50.200", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/opf/openproject/releases/tag/v17.0.2"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/opf/openproject/security/advisories/GHSA-fq66-cwg6-qq69"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,17.0.2)"}}], "product": "openproject", "vendor": "opf"}], "analysis": {"en": {"generated_at": "2026-04-18T13:01:06.978951+00:00", "value": {"mitigation_remediation": ["Upgrade to OpenProject\u202f17.0.2 or later to apply the vendor patch.", "Revoke the Manage Users permission from any users who do not require it, ensuring only trusted personnel retain account\u2011management rights.", "Continuously audit lock/unlock activity logs and set alerts for repeated lock attempts on administrator accounts to detect potential abuse."], "summary": {"action": "Immediate Patch", "impact": "Administrative Account Lockout"}, "threat_synthesis": {"affected_systems": "The vulnerability affects OpenProject installations prior to version 17.0.2. Any role with Manage Users rights, regardless of other privileges, can target administrator accounts. Versions 17.0.2 and later have the fix in place.", "description_and_impact": "OpenProject, an open\u2011source project\u2011management platform, contains a flaw that permits any user granted the Manage Users permission to lock or unlock any account, including those belonging to application administrators. The missing permission check allows a legitimate user to disable administrative access, resulting in a denial of service for critical management functions. The weakness is a missing authorization check, identified as CWE\u2011862.", "risk_and_exploitability": "The CVSS score of 6.7 indicates moderate severity, while the EPSS score of less than 1\u202f% reflects a very low probability of exploitation in the wild. The issue is not listed in the CISA KEV catalog. Exploitation requires a legitimate user with Manage Users rights, so an attacker would typically be an insider or one who has gained such permissions. Although it does not enable remote code execution, it permits administrative lock\u2011out, which can disrupt project\u2011management operations."}}}}, "created": "2026-02-10T11:35:19.319497+00:00", "updated": "2026-04-18T13:15:25.704446+00:00", "vendors": ["opf", "opf$PRODUCT$openproject"]}