CVE-2026-22602

Katalog CVE

CVSS 3.5 · Low EPSS 0,29%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada openproject. Skor CVSS 3.1 3.5 (Low) menurut github.com.

Deskripsi (NVD)

OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, a low‑privileged logged-in user can view the full names of other users. Since user IDs are assigned sequentially and predictably (e.g., 1 to 1000), an attacker can extract a complete list of all users’ full names by iterating through these URLs. The same behavior can also be reproduced via the OpenProject API, allowing automated retrieval of full names through the API as well. This issue has been patched in version 16.6.2. Those who are unable to upgrade may apply the patch manually.

Rincian

Terbit di NVD

10 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.5 (Low), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 19,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/opf/openproject/security/advisories/GHSA-7fvx-9h6h-g82j patch · advisory vendor
• https://github.com/opf/openproject/commit/fb39a779f521d9b08f1e0c9e8aff2b6d4643ea37 patch
• https://github.com/opf/openproject/pull/21281 issue tracking
• https://github.com/opf/openproject/releases/tag/v16.6.2 release notes