opf openproject up to 16.6.4/17.0.0 /my/sessions/ wrong session

Summaryinfo

A vulnerability categorized as problematic has been discovered in opf openproject up to 16.6.4/17.0.0. Affected by this issue is some unknown functionality of the file /my/sessions/. Such manipulation leads to wrong session. This vulnerability is traded as CVE-2026-23646. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in opf openproject up to 16.6.4/17.0.0. Affected by this issue is an unknown functionality of the file /my/sessions/. The manipulation with an unknown input leads to a wrong session vulnerability. Using CWE to declare the problem leads to CWE-488. The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session. Impacted is availability. CVE summarizes:

OpenProject is an open-source, web-based project management software. Users of OpenProject versions prior to 16.6.5 and 17.0.1 have the ability to view and end their active sessions via Account Settings → Sessions. When deleting a session, it was not properly checked if the session belongs to the user. As the ID that is used to identify these session objects use incremental integers, users could iterate requests using `DELETE /my/sessions/:id` and thus unauthenticate other users. Users did not have access to any sensitive information (like browser identifier, IP addresses, etc) of other users that are stored in the session. The problem was patched in OpenProject versions 16.6.5 and 17.0.1. No known workarounds are available as this does not require any permissions or other that can temporarily be disabled.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-23646 since 01/14/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available.

Upgrading to version 16.6.5 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-3308). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• opf

Name

• openproject

Version

• 16.6.0
• 16.6.1
• 16.6.2
• 16.6.3
• 16.6.4
• 17.0

Website

• Product: https://github.com/opf/openproject/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion