VYPR
← All advisories
High severity8.8OSV Advisory· Published Jun 26, 2026· Updated Jun 26, 2026

CVE-2026-52784

CVE-2026-52784

Description

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is a CSRF on TARGET through /users/:id via POST parameter "user[admin]". This vulnerability is fixed in 17.3.3 and 17.4.1.

Affected products

2
  • Opf/Openprojectllm-create2 versions
    <17.3.3, <17.4.1+ 1 more
    • (no CPE)range: <17.3.3, <17.4.1
    • (no CPE)range: v17.3.1, v17.4.0, v17.3.2, …

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.