CVE-2026-23646
Insecure Direct Object Reference in OpenProject Session Management
Publication date: 2026-01-19
Last updated on: 2026-02-02
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| opf | openproject | to 17.0.0 (exc) |
| openproject | openproject | to 16.6.5 (inc) |
| openproject | openproject | 17.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-488 | The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in OpenProject allows users to delete active sessions of other users because the system does not properly verify if a session belongs to the user attempting to delete it. Since session IDs are incremental integers, an attacker can iterate through session IDs using the DELETE /my/sessions/:id endpoint to unauthenticate other users without authorization. No sensitive information is exposed, but other users can be forcibly logged out. [2]
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an attacker to forcibly log out other users by deleting their active sessions. This affects the availability of your sessions and disrupts user access, although it does not expose sensitive information or compromise confidentiality or integrity. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves unauthorized deletion of active user sessions via the DELETE /my/sessions/:id endpoint by iterating incremental session IDs. Detection could involve monitoring HTTP DELETE requests to /my/sessions/ endpoints and checking for unusual patterns such as multiple DELETE requests with sequential session IDs from the same user or IP address. Network or application logs could be analyzed for such behavior. Specific commands depend on your logging and monitoring setup, but for example, using grep on server logs: grep 'DELETE /my/sessions/' /path/to/access.log to identify suspicious session deletion attempts. [2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update OpenProject to version 16.6.5 or 17.0.1 or later, where the vulnerability has been patched. No temporary workarounds or permission changes are available to mitigate this issue. Promptly applying the update will prevent unauthorized session deletions. [2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.