opf openproject up to 16.6.1 API information disclosure

Summaryinfo

A vulnerability labeled as problematic has been found in opf openproject up to 16.6.1. This affects an unknown function of the component API. The manipulation results in information disclosure. This vulnerability is reported as CVE-2026-22602. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, was found in opf openproject up to 16.6.1. Affected is an unknown part of the component API. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. CVE summarizes:

OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, a low‑privileged logged-in user can view the full names of other users. Since user IDs are assigned sequentially and predictably (e.g., 1 to 1000), an attacker can extract a complete list of all users’ full names by iterating through these URLs. The same behavior can also be reproduced via the OpenProject API, allowing automated retrieval of full names through the API as well. This issue has been patched in version 16.6.2. Those who are unable to upgrade may apply the patch manually.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-22602 since 01/07/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 16.6.2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch fb39a779f521d9b08f1e0c9e8aff2b6d4643ea37 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-1885). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Project Management Software

Vendor

• opf

Name

• openproject

Version

• 16.6.0
• 16.6.1

License

• open-source

Website

• Product: https://github.com/opf/openproject/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion