CVE-2026-22604: OpenProject is vulnerable to user enumeration via the change password function
OpenProject is an open-source, web-based project management software. For OpenProject versions from 11.2.1 to before 16.6.2, when sending a POST request to the /account/changepassword endpoint with an arbitrary User ID as the passwordchangeuserid parameter, the resulting error page would show the username for the requested user. Since this endpoint is intended to be called without being authenticated, this allows to enumerate the user names of all accounts registered in an OpenProject instance. This issue has been patched in version 16.6.2.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22604?
CVE-2026-22604 is considered a medium severity vulnerability due to its potential impact on user authentication.
How do I fix CVE-2026-22604?
To fix CVE-2026-22604, upgrade OpenProject to version 16.6.2 or later.
What specific version of OpenProject is affected by CVE-2026-22604?
CVE-2026-22604 affects OpenProject versions from 11.2.1 up to, but not including, 16.6.2.
What kind of attack does CVE-2026-22604 facilitate?
CVE-2026-22604 facilitates password change manipulation through unauthorized POST requests.
Is there a mitigation strategy for CVE-2026-22604 before upgrading?
While upgrading is the best option, temporarily restricting access to the /account/change_password endpoint can mitigate CVE-2026-22604.