Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2026-22604

Good to know:

icon

Date: January 9, 2026

OpenProject is an open-source, web-based project management software. For OpenProject versions from 11.2.1 to before 16.6.2, when sending a POST request to the /account/change_password endpoint with an arbitrary User ID as the password_change_user_id parameter, the resulting error page would show the username for the requested user. Since this endpoint is intended to be called without being authenticated, this allows to enumerate the user names of all accounts registered in an OpenProject instance. This issue has been patched in version 16.6.2.

Severity Score

Related Resources (6)

https://nvd.nist.gov/vuln/detail/CVE-2026-22604
https://github.com/opf/openproject/releases/tag/v16.6.2
https://github.com/opf/openproject/pull/3451
https://github.com/opf/openproject/commit/2cff5e98649e32a197a62659a23dd4b864b7855b
https://github.com/opf/openproject/security/advisories/GHSA-q7qp-p3vw-j2fh
https://www.mend.io/vulnerability-database/CVE-2026-22604

Severity Score

Weakness Type (CWE)

Exposure of Sensitive Information to an Unauthorized Actor

CWE-200

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us