CVE-2026-22604CWE-200

OpenProject is vulnerable to user enumeration via the change password function

Medium · published January 10, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
21.7
In the wild
Unconfirmed
What it is

OpenProject is an open-source, web-based project management software. For OpenProject versions from 11.2.1 to before 16.6.2, when sending a POST request to the /account/change_password endpoint with an arbitrary User ID as the password_change_user_id parameter, the resulting error page would show the username for the requested user. Since this endpoint is intended to be called without being authenticated, this allows to enumerate the user names of all accounts registered in an OpenProject instance. This issue has been patched in version 16.6.2.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00302 · 21.7th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-01-10T01:07Z
EPSS history
Timeline
  • 10 JAN 01:07Z
    OpenProject is vulnerable to user enumeration via the change password function
    cvelistv5