CVE-2026-44731: OpenProject User Enumeration via Meetings Filter

Technical summary

The vulnerability resides in OpenProject's meetings filter functionality, which improperly reveals account existence and user metadata through observable response differences. When an attacker submits filter requests containing valid versus invalid user IDs, the application returns distinguishable responses, effectively creating an oracle for account enumeration. This is classified as an information disclosure flaw (CWE-639: Authorization Through User-Controlled Key) because the authorization model fails to consistently protect user identity information across all code paths. The flaw requires authenticated access—an attacker must already have valid OpenProject credentials.

Business impact

User enumeration undermines account confidentiality and supports targeted social engineering or credential-stuffing attacks by confirming which accounts exist before attempts are made. Organizations managing sensitive projects or multi-tenant deployments may face compliance concerns if user rosters are intended to remain private. The medium severity rating reflects the requirement for prior authentication; external threat actors cannot exploit this without first obtaining credentials. However, insider threats or accounts created for temporary access become more dangerous when they can systematically harvest the organizational directory.

Affected systems

OpenProject versions prior to 17.3.2 and 17.4.0 are affected. The vulnerability is resolved in those patch versions. Organizations should verify their deployed version and plan updates accordingly. No other products or vendors are identified as affected by this specific issue.

Exploitability

Exploitation requires valid OpenProject login credentials, limiting this to authenticated users or threat actors who have compromised or been granted an account. The attack is trivial to execute once authenticated—an attacker simply probes the meetings filter with sequential or targeted user IDs and compares response patterns. The attack is repeatable, deterministic, and requires no user interaction. The low barrier to execution is offset by the authentication prerequisite; this is not a worm vector or remotely exploitable without prior account compromise.

Remediation

Upgrade OpenProject to version 17.3.2 or 17.4.0 or later. Organizations should prioritize patching if they manage multi-tenant environments, host sensitive projects, or classify user directories as confidential. For environments where an immediate patch is not feasible, restrict meetings filter access to trusted internal roles and monitor for unusual filter activity.

Patch guidance

Apply the available patches (17.3.2 or 17.4.0) through OpenProject's standard update process. Verify patch installation by confirming the version in the application settings and testing that the meetings filter no longer discloses user information to authenticated users performing enumeration attempts. Patch testing should include validation that legitimate meetings filtering functionality remains intact.

Detection guidance

Monitor logs for repeated meetings filter requests with varying user ID parameters, particularly from single accounts in short time windows. Successful enumeration would manifest as high-volume probing against the /meetings filter endpoint. Analyze authentication logs for accounts making unusual numbers of API calls to user-related endpoints. Establish a baseline of normal filter usage to detect anomalous patterns.

Why prioritize this

Prioritize this patch for environments where internal user directory confidentiality is important, where account enumeration could facilitate social engineering campaigns, or where insider threat risk is elevated. Organizations with strict multi-tenant isolation requirements should treat this as higher priority. The medium CVSS score reflects the requirement for prior authentication; patch timing can be coordinated with standard maintenance windows unless you operate a high-sensitivity environment.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) reflects low confidentiality impact on a limited scope (user account names and existence), low complexity exploitation for authenticated users, and no direct impact to integrity or availability. The score correctly penalizes the authentication prerequisite while acknowledging the complete lack of user interaction required once authenticated. Organizations handling highly sensitive user data may reasonably assess risk as locally higher, but the base score accurately represents the flaw's severity in typical deployments.

Frequently asked questions