PT-2026-52915 · Unknown · Openproject

CVE-2026-52784

·

Published

2026-06-26

·

Updated

2026-06-26

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.3.3 OpenProject versions prior to 17.4.1
Description Cross-Site Request Forgery (CSRF) occurs when an attacker tricks a victim into performing actions they did not intend to do. The issue exists in the '/users/:id' endpoint via the user[admin] POST parameter.
Recommendations Update to version 17.3.3. Update to version 17.4.1.

Exploit

Fix

CSRF

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-52784
GHSA-6CRW-7F5R-4QJ9

Affected Products

Openproject