CVE-2026-23646 Details
Description
OpenProject is an open-source, web-based project management software. Users of OpenProject versions prior to 16.6.5 and 17.0.1 have the ability to view and end their active sessions via Account Settings → Sessions. When deleting a session, it was not properly checked if the session belongs to the user. As the ID that is used to identify these session objects use incremental integers, users could iterate requests using `DELETE /my/sessions/:id` and thus unauthenticate other users. Users did not have access to any sensitive information (like browser identifier, IP addresses, etc) of other users that are stored in the session. The problem was patched in OpenProject versions 16.6.5 and 17.0.1. No known workarounds are available as this does not require any permissions or other that can temporarily be disabled.
A vulnerability exists in OpenProject versions prior to 16.6.5 and 17.0.1, allowing users to terminate other users' active sessions. This issue arises because the application does not properly verify session ownership when a session is deleted. Users can exploit this by sending requests to delete sessions using the session ID, which is an incremental integer. Although this vulnerability does not expose any sensitive information from the session, it improperly disrupts other users' sessions.
Users are advised to update OpenProject to version 16.6.5 or 17.0.1.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/opf/openproject/releases/tag/v16.6.5 | [email protected] | Release Notes |
| https://github.com/opf/openproject/releases/tag/v17.0.1 | [email protected] | Release Notes |
| https://github.com/opf/openproject/security/advisories/GHSA-w422-xf8f-v4vp | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-488 | Exposure of Data Element to Wrong Session | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openproject openproject | < 16.6.5 17.0.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 2, 2026 | Initial Analysis | [email protected] |
| Jan 19, 2026 | New CVE Received | [email protected] |