CVE-2026-44733: OpenProject Password Change API Bypass Vulnerability

Technical summary

CVE-2026-44733 is a business logic error in OpenProject's password change functionality, specifically in the /api/v3/users/me endpoint when accessed via PATCH request. The vulnerability stems from insufficient password validation during the change password operation. The flaw allows an attacker with an active user session to bypass password requirements and modify credentials without proper confirmation or validation checks. The attack vector is network-based, requires an existing authenticated session (low privilege level), and does not require user interaction. The impact is primarily confidentiality and integrity focused, with limited ability to affect availability. Remediation is available in OpenProject 17.3.2 and 17.4.0.

Business impact

This vulnerability presents a moderate but meaningful risk to organizations deploying OpenProject. The primary concern is account takeover: if an attacker gains session access to any user account—through phishing, network sniffing, or credential compromise—they can immediately escalate that breach by changing the account password to maintain persistent access. This is particularly damaging for administrative accounts or project leads who manage sensitive project data. The ability to change passwords without confirmation also raises compliance concerns for organizations subject to regulatory frameworks requiring strong access controls (SOC 2, ISO 27001, HIPAA). For multi-user teams relying on OpenProject for project tracking and collaboration, a compromised account could lead to unauthorized access to project plans, timelines, and sensitive work product.

Affected systems

OpenProject versions prior to 17.3.2 and 17.4.0 are affected. The vulnerability is not tracked as an active zero-day in CISA's Known Exploited Vulnerabilities (KEV) catalog. Any OpenProject deployment running versions before the fixed releases is at risk, regardless of deployment model (cloud-hosted or self-managed). Organizations should check their current OpenProject version against the fixed versions listed.

Exploitability

Exploitation requires an attacker to possess an active authenticated session to a legitimate user account. This is not a remote unauthenticated attack; the attacker must already have session access, which could be obtained through credential theft, session hijacking, phishing, or lateral movement within a compromised network. Once session access is established, the technical barrier to exploitation is low—a simple PATCH request to the documented API endpoint with minimal additional interaction is required. The attack leaves minimal artifacts and can occur without alerting the legitimate user until they attempt to log in with their original credentials. However, the necessity of pre-existing session access significantly constrains the attack surface compared to unauthenticated vulnerabilities.

Remediation

Organizations should upgrade OpenProject to version 17.3.2 or 17.4.0 or later as soon as possible. For environments unable to upgrade immediately, consider implementing network-level controls to restrict access to the /api/v3/users/me endpoint to trusted networks, or implement additional session security measures such as enforcing short session timeouts and monitoring for unusual account activity. Review session logs for any evidence of unauthorized password changes prior to patching.

Patch guidance

Verify your current OpenProject version by checking the administration panel or inspecting the package metadata. Upgrade to OpenProject 17.3.2 (for the 17.3.x branch) or 17.4.0 or later (for the 17.4.x branch or newer). Follow the vendor's documented upgrade procedure, which typically involves backing up your database, downloading the new release, and running database migrations. Test the upgrade in a non-production environment first if possible. After patching, verify that password change functionality works as expected and confirm no user sessions persist with unexpected privileges.

Detection guidance

Monitor API logs for PATCH requests to /api/v3/users/me, particularly those originating from unexpected network locations or during off-hours. Look for multiple password change attempts from the same session in short timeframes, or password changes followed immediately by login attempts from different IP addresses. Enable audit logging in OpenProject if available, and correlate password change events with session origination data. Detect anomalous user behavior such as sudden changes to user profiles or permissions following a password reset. Consider implementing Web Application Firewall (WAF) rules to flag or block suspicious PATCH requests to sensitive endpoints until patches are applied.

Why prioritize this

While the CVSS score of 5.9 (MEDIUM) reflects the authentication requirement, the practical risk is elevated by the password-change use case, which enables account takeover and persistent access. The vulnerability should be prioritized above purely informational or limited-impact medium-severity issues because it directly threatens account security and could enable lateral movement or data exfiltration. However, it is not critical if your organization's session security posture is strong (short timeouts, monitoring for hijacking). Patches are available and straightforward to apply, making this an ideal candidate for rapid remediation in your patch cycle.

Risk score, explained

The CVSS 3.1 score of 5.9 reflects: (1) Network-based attack vector, (2) High complexity due to the requirement for an active user session and potential need to navigate application logic, (3) Low privilege requirement (an authenticated user), (4) No user interaction required, (5) High confidentiality impact (password change enables account takeover), (6) Low integrity impact (the password change itself is the integrity violation, but impact beyond the account is limited), (7) No availability impact. The score appropriately penalizes the authentication requirement but recognizes the severity of the password validation bypass itself. Organizations should treat this as a material vulnerability despite the medium rating due to the password-takeover scenario and its implications for persistent access.

Frequently asked questions