VYPR
← All advisories
Unrated severityOSV Advisory· Published Jun 26, 2026· Updated Jun 26, 2026

OpenProject: CSRF on TARGET through /users/:id via POST parameter "user[admin]"

CVE-2026-52784

Description

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is a CSRF on TARGET through /users/:id via POST parameter "user[admin]". This vulnerability is fixed in 17.3.3 and 17.4.1.

Affected products

2
  • Opf/OpenprojectOSV2 versions
    v17.3.1, v17.4.0, v17.3.2, …+ 1 more
    • (no CPE)range: v17.3.1, v17.4.0, v17.3.2, …
    • (no CPE)range: <17.3.3, <17.4.1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.