CSRF in OpenProject via User Admin Parameter

Executive Summary

CVE-2026-52784 is a Cross-Site Request Forgery (CSRF) vulnerability affecting OpenProject versions prior to 17.3.3 and 17.4.1. It occurs through the /users/:id endpoint via the POST parameter "user[admin]". An attacker can exploit Turbo Drive's auto-injection of CSRF tokens by injecting a form through a Cross-Site Scripting (XSS) attack and then automatically submitting it using a dispatch_event action named "submit". This means the attack can happen with minimal user interaction, as the form submits automatically when a user views a work package.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is a Cross-Site Request Forgery (CSRF) issue affecting OpenProject versions prior to 17.3.3 and 17.4.1. Detection involves verifying the version of OpenProject running on your system.

You can check the OpenProject version by accessing the application interface or by running commands on the server hosting OpenProject.

• Check the OpenProject version via the web interface or API.
• On the server, run a command to check the installed OpenProject package version, for example: `dpkg -l | grep openproject` (on Debian-based systems) or `rpm -qa | grep openproject` (on RedHat-based systems).
• Monitor HTTP POST requests to the /users/:id endpoint and inspect if the POST parameter "user[admin]" is being manipulated or exploited.

Since the vulnerability exploits CSRF via POST requests, network monitoring tools or web application firewalls (WAF) can be configured to log or block suspicious POST requests targeting /users/:id with the parameter "user[admin]".

Useful 0 Not Useful 0

Impact Analysis

This vulnerability has a high severity score of 8.8 (CVSS v3) and can impact confidentiality, integrity, and availability at a high level. An attacker could gain unauthorized access, modify data, or disrupt the service by exploiting this CSRF flaw. The attack requires low privileges and no user interaction, making it easier for attackers to compromise the system.

Useful 0 Not Useful 0

Compliance Impact

The CVE-2026-52784 vulnerability allows an attacker to perform unauthorized actions on behalf of a user due to a Cross-Site Request Forgery (CSRF) flaw. This can lead to unauthorized access, modification of data, and disruption of service, impacting confidentiality, integrity, and availability at a high level.

Such impacts can affect compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data, ensuring data integrity and availability. A vulnerability that compromises these security principles may lead to violations of these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

The primary and immediate mitigation step is to upgrade OpenProject to version 17.3.3 or 17.4.1 or later, where this CSRF vulnerability has been fixed.

Until the upgrade can be performed, consider implementing additional CSRF protections such as enabling or enforcing CSRF tokens on POST requests and using web application firewalls to block suspicious requests targeting the vulnerable endpoint.

Also, restrict user privileges to minimize the impact of potential exploitation, as the vulnerability requires low privileges but can cause high impact.

Useful 0 Not Useful 0