CVE-2026-44731: OpenProject: Improper Access Control on OpenProject through /projects/[projectName]/meetings via "invited_user_id" in GET parameter "filters" leads to user names disclosure
OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the web application's meetings filter feature leaks whether a given user ID corresponds to a valid account and discloses the user's full name, allowing an attacker to enumerate all existing user accounts by probing user IDs and observing differences in the server response. This vulnerability is fixed in 17.3.2 and 17.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.3.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.4.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44731?
CVE-2026-44731 has a medium severity rating of 4.3.
What vulnerability does CVE-2026-44731 describe?
CVE-2026-44731 describes improper access control in OpenProject that leads to user name disclosure through a GET parameter.
How do I fix CVE-2026-44731?
To fix CVE-2026-44731, update OpenProject to version 17.3.2 or 17.4.0 or later.
What type of users can be affected by CVE-2026-44731?
CVE-2026-44731 affects users of OpenProject who have access to the meetings filter feature.
What is the impact of CVE-2026-44731?
The impact of CVE-2026-44731 is that it allows an attacker to enumerate valid user accounts by disclosing user full names.