Vulnerability · Published Jan 10, 2026 · Assigned by GitHub_M

CVE-2026-22602OpenProject is Vulnerable to User Enumeration via User ID

Low 3.5

In plain English

A low-severity information exposure in openproject from opf. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.3%top 78.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, a low‑privileged logged-in user can view the full names of other users. Since user IDs are assigned sequentially and predictably (e.g., 1 to 1000), an attacker can extract a complete list of all users’ full names by iterating through these URLs. The same behavior can also be reproduced via the OpenProject API, allowing automated retrieval of full names through the API as well. This issue has been patched in version 16.6.2. Those who are unable to upgrade may apply the patch manually.

Affected products (as reported)

Vendor	Product	Versions
opf	openproject	< 16.6.2

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

References

https://github.com/opf/openproject/security/advisories/GHSA-7fvx-9h6h-g82j x_refsource_CONFIRM
https://github.com/opf/openproject/pull/21281 x_refsource_MISC
https://github.com/opf/openproject/commit/fb39a779f521d9b08f1e0c9e8aff2b6d4643ea37 x_refsource_MISC
https://github.com/opf/openproject/releases/tag/v16.6.2 x_refsource_MISC