CVE-2026-52784: OpenProject CSRF Vulnerability – Admin Privilege Escalation

Technical summary

A CSRF vulnerability (CWE-352) exists in the OpenProject user management API at the /users/:id endpoint. The vulnerability allows an authenticated attacker to modify the 'user[admin]' parameter via POST requests without proper CSRF token validation. The attacker can craft a request that, when executed by a logged-in administrator, grants or revokes admin privileges on arbitrary user accounts. The issue affects all versions prior to 17.3.3 (in the 17.3.x branch) and prior to 17.4.1 (in the 17.4.x branch). The vulnerability requires the victim to be authenticated and does not require user interaction beyond visiting a malicious page while maintaining an active OpenProject session.

Business impact

Compromise of administrative accounts in OpenProject could lead to unauthorized access to sensitive project data, modification of project timelines and assignments, deletion of critical work records, and potential lateral movement if OpenProject is integrated with other business systems. In organizations using OpenProject for compliance-critical workflows, unauthorized admin access could result in audit failures and regulatory violations. The CVSS 8.8 HIGH score reflects the combination of high confidentiality, integrity, and availability impact on affected systems.

Affected systems

OpenProject versions 17.3.0 through 17.3.2 and 17.4.0 are affected. Organizations running these versions with multiple users or federated authentication should prioritize patching. Self-hosted OpenProject installations are directly affected; SaaS customers should verify their instance version and patch status with OpenProject operators.

Exploitability

Exploitation requires an authenticated attacker with network access and knowledge that a target user is logged into OpenProject. No special tooling is needed—a simple HTML form or redirect can trigger the CSRF. The low complexity and lack of user interaction requirements (beyond the victim being authenticated) make this moderately straightforward to exploit in practice, though the attacker must have credentials or be able to socially engineer a user into visiting a malicious link. The attack is more likely to succeed in environments with poor security awareness.

Remediation

Upgrade OpenProject to version 17.3.3 or later (if on the 17.3.x branch) or to version 17.4.1 or later (if on the 17.4.x branch). Before upgrading, review the official OpenProject release notes to confirm compatibility with your deployment and any custom extensions. Test patches in a non-production environment first. Additionally, implement defense-in-depth measures such as enforcing SameSite cookie attributes, requiring re-authentication for sensitive operations, and monitoring for unusual admin account modifications.

Patch guidance

Download and install the patched versions from the official OpenProject repository. If you are on version 17.3.x, upgrade to 17.3.3 or later. If you are on version 17.4.x, upgrade to 17.4.1 or later. Verify the integrity of downloaded packages using checksums provided by OpenProject. After patching, clear browser caches and restart OpenProject services. Test admin functionality and confirm user privilege levels remain as expected post-upgrade.

Detection guidance

Monitor OpenProject audit logs for unexpected changes to user admin status, particularly modifications initiated by accounts other than dedicated administrators. Look for POST requests to /users/:id endpoints with unusual referrer headers or without proper CSRF tokens. Deploy Web Application Firewall (WAF) rules to detect cross-origin POST requests to user management endpoints. Track authentication logs for sessions that precede admin modifications. In a detection-focused approach, flag any admin privilege changes that occur within seconds of a user visiting an external link.

Why prioritize this

HIGH severity due to CVSS 8.8 score and direct impact on access control. Authenticated privilege escalation in project management software can compromise all downstream project visibility and integrity. Organizations managing sensitive projects, compliance-critical workflows, or regulatory requirements should prioritize this immediately. Even with the requirement for an authenticated attacker, the impact on confidentiality, integrity, and availability justifies urgent patching.

Risk score, explained

CVSS 3.1 score of 8.8 (HIGH) reflects: Network-based attack vector (AV:N), low attack complexity (AC:L), low privilege requirement (PR:L for authenticated user), no special user interaction beyond session existence (UI:N), unchanged scope (S:U), and high impact across all three security properties (C:H/I:H/A:H). The score acknowledges that while an attacker must be authenticated, the consequence of successful exploitation—complete compromise of administrative access—is severe.

Frequently asked questions