CVE-2026-22602

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, a low‑privileged logged-in user can view the full names of other users. Since user IDs are assigned sequentially and predictably (e.g., 1 to 1000), an attacker can extract a complete list of all users’ full names by iterating through these URLs. The same behavior can also be reproduced via the OpenProject API, allowing automated retrieval of full names through the API as well. This issue has been patched in version 16.6.2. Those who are unable to upgrade may apply the patch manually.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Jan 10, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-226036.5OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, OpenProject’s unauthenticated password-changeCVE-2026-226045.3OpenProject is an open-source, web-based project management software. For OpenProject versions from 11.2.1 to before 16.6.2, when sending a CVE-2026-226054.3OpenProject is an open-source, web-based project management software. OpenProject versions prior to version 16.6.3, allowed users with the VCVE-2026-226067.8Fickling is a Python pickling decompiler and static analyzer. Fickling versions up to and including 0.1.6 do not treat Python’s runpy moduleCVE-2026-226077.8Fickling is a Python pickling decompiler and static analyzer. Fickling versions up to and including 0.1.6 do not treat Python's cProfile modCVE-2026-226087.8Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, both ctypes and pydoc modules aren't explicitly blockeCVE-2026-226097.8Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, the unsafe_imports() method in Fickling's static analyCVE-2026-22617.5Due to a programming error, blocklistd leaks a socket descriptor for each adverse event report it receives. Once a certain number of leakedCVE-2026-226106.1Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior toCVE-2026-226113.7AWS SDK for .NET works with Amazon Web Services to help build scalable solutions with Amazon S3, Amazon DynamoDB, Amazon Glacier, and more. CVE-2026-226127.8Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, Fickling is vulnerable to detection bypass due to "buiCVE-2026-226135.7The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attac