Low severity · published Jan 10, 2026
CVE-2026-22602
OpenProject is Vulnerable to User Enumeration via User ID
3.5
CVSS
0.3%
EPSS
No
On KEV
Description
OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, a low‑privileged logged-in user can view the full names of other users. Since user IDs are assigned sequentially and predictably (e.g., 1 to 1000), an attacker can extract a complete list of all users’ full names by iterating through these URLs. The same behavior can also be reproduced via the OpenProject API, allowing automated retrieval of full names through the API as well. This issue has been patched in version 16.6.2. Those who are unable to upgrade may apply the patch manually.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openproject · opf
< 16.6.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-22602
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-22602
Patch
https://github.com/opf/openproject/commit/fb39a779f521d9b08f1e0c9e8aff2b6d4643ea37
Issue Tracking
https://github.com/opf/openproject/pull/21281
Release Notes
https://github.com/opf/openproject/releases/tag/v16.6.2
Patch
https://github.com/opf/openproject/security/advisories/GHSA-7fvx-9h6h-g82j
More from openproject
9.9
CVE-2026-46386
OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`
9.9
CVE-2026-52782
OpenProject: IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[project_folder_id]" leads to Access to Unauthorized Resources
9.9
CVE-2026-52785
OpenProject: SQL injection in timestamps functionality
9.9
CVE-2026-25763
Command Injection on OpenProject repositories leads to Remote Code Execution
9.6
CVE-2026-52780
OpenProject: Cache store poisoning leads to Remote Code Execution (RCE)