CVE-2026-24777: OpenProject has Improper Access Control on User Management allows user managers to lock admin accounts
OpenProject is an open-source, web-based project management software. Prior to 17.0.2, users with the Manage Users permission can lock and unlock users. This functionality should only be possible for users of the application, but they were not supposed to be able to lock application administrators. Due to a missing permission check this logic was not enforced. The problem was fixed in OpenProject 17.0.2The problem was fixed in OpenProject 17.0.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24777?
CVE-2026-24777 has a medium severity level due to improper access control in user management.
How do I fix CVE-2026-24777?
To fix CVE-2026-24777, upgrade OpenProject to version 17.0.2 or later.
Who is affected by CVE-2026-24777?
Users with Manage Users permission are affected by CVE-2026-24777 when using OpenProject versions prior to 17.0.2.
What type of vulnerability is CVE-2026-24777?
CVE-2026-24777 is an access control vulnerability.
What functionality is improperly allowed in CVE-2026-24777?
CVE-2026-24777 improperly allows user managers to lock and unlock admin accounts.