What’s Vulnerable › Vulnerabilities

CVE-2026-22602: OpenProject is Vulnerable to User Enumeration via User ID

• Severity: low (CVSS 3.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-10 · updated 2026-06-17
• Weakness: CWE-200

Description

OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, a low‑privileged logged-in user can view the full names of other users. Since user IDs are assigned sequentially and predictably (e.g., 1 to 1000), an attacker can extract a complete list of all users’ full names by iterating through these URLs. The same behavior can also be reproduced via the OpenProject API, allowing automated retrieval of full names through the API as well. This issue has been patched in version 16.6.2. Those who are unable to upgrade may apply the patch manually.

Affected products

• opf openproject: before 16.6.2 — fixed in 16.6.2

How to fix

Upgrade to a fixed version: opf openproject 16.6.2. Check the vendor advisory for mitigations.

References

• https://github.com/opf/openproject/commit/fb39a779f521d9b08f1e0c9e8aff2b6d4643ea37
• https://github.com/opf/openproject/pull/21281
• https://github.com/opf/openproject/releases/tag/v16.6.2
• https://github.com/opf/openproject/security/advisories/GHSA-7fvx-9h6h-g82j

Get alerted when CVE-2026-22602 or the next vulnerability affects your stack