CVE-2026-24777

MEDIUM

6.7

Descripcion

OpenProject is an open-source, web-based project management software. Prior to 17.0.2, users with the Manage Users permission can lock and unlock users. This functionality should only be possible for users of the application, but they were not supposed to be able to lock application administrators. Due to a missing permission check this logic was not enforced. The problem was fixed in OpenProject 17.0.2The problem was fixed in OpenProject 17.0.2.

Detalles CVE

Puntuacion CVSS v3.16.7

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosHIGH

Interaccion usuarioNONE

Publicado2/9/2026

Ultima modificacion2/11/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

openproject:openproject

Debilidades (CWE)

CWE-862

Referencias

https://github.com/opf/openproject/releases/tag/v17.0.2(security-advisories@github.com)

https://github.com/opf/openproject/security/advisories/GHSA-fq66-cwg6-qq69(security-advisories@github.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.