Insufficient Permission Checks in OpenProject Affecting User Management

CVE-2026-24777

What is CVE-2026-24777?

A security issue exists in OpenProject, an open-source project management tool, where users with the Manage Users permission can unintentionally lock or unlock other users, including application administrators. This flaw arises from a lack of necessary permission checks, allowing potential unauthorized access to critical user management functionalities. The vulnerability was addressed in version 17.0.2, which enforced stricter validation to prevent such actions.

References