Vulnerability · Published Jan 10, 2026 · Assigned by GitHub_M

CVE-2026-22604OpenProject is vulnerable to user enumeration via the change password function

Medium 6.9

In plain English

A medium-severity information exposure in openproject from opf. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.3%top 76.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenProject is an open-source, web-based project management software. For OpenProject versions from 11.2.1 to before 16.6.2, when sending a POST request to the /account/change_password endpoint with an arbitrary User ID as the password_change_user_id parameter, the resulting error page would show the username for the requested user. Since this endpoint is intended to be called without being authenticated, this allows to enumerate the user names of all accounts registered in an OpenProject instance. This issue has been patched in version 16.6.2.

Affected products (as reported)

Vendor	Product	Versions
opf	openproject	>= 11.2.1, < 16.6.2

Weakness: CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/opf/openproject/security/advisories/GHSA-q7qp-p3vw-j2fh x_refsource_CONFIRM
https://github.com/opf/openproject/pull/3451 x_refsource_MISC
https://github.com/opf/openproject/commit/2cff5e98649e32a197a62659a23dd4b864b7855b x_refsource_MISC
https://github.com/opf/openproject/releases/tag/v16.6.2 x_refsource_MISC