CVE-2026-52784 Details
Description
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is a CSRF on TARGET through /users/:id via POST parameter "user[admin]". This vulnerability is fixed in 17.3.3 and 17.4.1.
A cross-site request forgery (CSRF) vulnerability has been identified in OpenProject, an open-source web-based project management tool. This issue affects versions prior to 17.3.3 and 17.4.1. The vulnerability arises in the user administration feature, specifically through the '/users/:id' endpoint, via the POST parameter 'user[admin]'. Exploitation of this vulnerability is facilitated by Turbo Drive, which automatically injects CSRF tokens from the meta tag into forms. These forms can be submitted without user interaction, leading to unauthorized changes in user admin status.
Users can upgrade to OpenProject versions 17.3.3 or 17.4.1 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 26, 2026CISA-ADP
Assessed Jun 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/opf/openproject/security/advisories/GHSA-6crw-7f5r-4qj9 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenProject | < 17.3.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | New CVE Received | [email protected] |
| Jun 26, 2026 | CVE Modified | CISA-ADP |