What’s Vulnerable › Vulnerabilities

CVE-2026-22604: OpenProject is vulnerable to user enumeration via the change password function

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-10 · updated 2026-06-17
• Weakness: CWE-200

Description

OpenProject is an open-source, web-based project management software. For OpenProject versions from 11.2.1 to before 16.6.2, when sending a POST request to the /account/change_password endpoint with an arbitrary User ID as the password_change_user_id parameter, the resulting error page would show the username for the requested user. Since this endpoint is intended to be called without being authenticated, this allows to enumerate the user names of all accounts registered in an OpenProject instance. This issue has been patched in version 16.6.2.

Affected products

• opf openproject: from 11.2.1 before 16.6.2 — fixed in 16.6.2

How to fix

Upgrade to a fixed version: opf openproject 16.6.2. Check the vendor advisory for mitigations.

References

• https://github.com/opf/openproject/commit/2cff5e98649e32a197a62659a23dd4b864b7855b
• https://github.com/opf/openproject/pull/3451
• https://github.com/opf/openproject/releases/tag/v16.6.2
• https://github.com/opf/openproject/security/advisories/GHSA-q7qp-p3vw-j2fh

Get alerted when CVE-2026-22604 or the next vulnerability affects your stack