CVE-2026-23646: OpenProject Auth Bypass Vulnerability

CVE-2026-23646 Overview

A vulnerability has been identified in OpenProject, an open-source web-based project management software, that allows authenticated users to terminate other users' sessions through an Insecure Direct Object Reference (IDOR) flaw. The vulnerability exists in the session management functionality accessible via Account Settings → Sessions, where the application fails to properly validate session ownership before deletion.

When a user attempts to delete a session through the DELETE /my/sessions/:id endpoint, the application does not verify that the session belongs to the requesting user. Because session object identifiers use predictable incremental integers, an attacker can enumerate and delete arbitrary user sessions, effectively forcing other users to be unauthenticated from the application.

Critical Impact

Authenticated attackers can terminate any user's active sessions by iterating through session IDs, causing widespread denial of service and disrupting project management workflows across the organization.

Affected Products

• OpenProject versions prior to 16.6.5
• OpenProject versions prior to 17.0.1

Discovery Timeline

• 2026-01-19 - CVE-2026-23646 published to NVD
• 2026-01-19 - Last updated in NVD database

Technical Details for CVE-2026-23646

Vulnerability Analysis

This vulnerability is classified as CWE-488 (Exposure of Data Element to Wrong Session). The core issue lies in the absence of authorization checks within the session deletion functionality. When users access the session management interface, they can view and terminate their own active sessions—a legitimate security feature. However, the backend implementation fails to enforce ownership validation when processing session deletion requests.

The attack requires only low-privileged authenticated access to the OpenProject instance. Once authenticated, an attacker can craft HTTP DELETE requests to the /my/sessions/:id endpoint with arbitrary session identifiers. Since the session IDs follow a predictable sequential integer pattern, attackers can systematically iterate through ID values to terminate sessions belonging to other users.

While the vulnerability does not expose sensitive session information such as browser identifiers, IP addresses, or authentication tokens, it creates a significant availability impact. Targeted attacks could log out administrators during critical operations, or mass enumeration could disrupt all active users across an organization.

Root Cause

The root cause is improper access control in the session management controller. The application implements session deletion functionality without verifying that the session ID in the request corresponds to a session owned by the authenticated user making the request. This authorization bypass occurs because the controller trusts the user-supplied session ID without cross-referencing it against the current user's session records.

Additionally, the use of sequential integer identifiers for session objects creates a predictable enumeration vector. Combined with the missing ownership check, this design flaw transforms a minor ID predictability issue into an exploitable denial of service vulnerability.

Attack Vector

The attack is network-based and requires low-privileged authentication to the OpenProject application. An attacker proceeds through the following steps:

1. Authenticate to the OpenProject instance with any valid user account
2. Navigate to Account Settings → Sessions to observe the session management interface
3. Capture a legitimate session deletion request to understand the API endpoint structure
4. Modify the session ID parameter in the DELETE request to target other session IDs
5. Iterate through sequential integer values to terminate sessions belonging to other users

The vulnerability can be exploited through simple HTTP request manipulation. An attacker would send requests to the endpoint DELETE /my/sessions/:id while incrementing or decrementing the ID value to target sessions belonging to other users. This can be automated to quickly terminate all active sessions in the system, causing mass user disconnection.

For technical implementation details, refer to the GitHub Security Advisory GHSA-w422-xf8f-v4vp.

Detection Methods for CVE-2026-23646

Indicators of Compromise

• Unusual volume of DELETE requests to /my/sessions/:id endpoint from a single user
• Sequential or patterned session ID values in deletion requests
• Correlation between session deletion requests and unexpected user logout events
• Multiple users reporting simultaneous session terminations without explicit logout actions

Detection Strategies

• Monitor web server logs for excessive DELETE requests to the session management endpoint from individual user accounts
• Implement rate limiting detection on the /my/sessions/:id endpoint to identify enumeration attempts
• Create alerts for session deletion events where the target session ID does not belong to the requesting user
• Deploy application-layer intrusion detection rules to identify sequential parameter manipulation patterns

Monitoring Recommendations

• Enable detailed request logging for the session management API endpoints
• Configure SIEM rules to correlate session deletion events with unexpected authentication failures
• Implement user behavior analytics to detect anomalous session management activity patterns
• Monitor for spikes in authenticated API requests to session-related endpoints

How to Mitigate CVE-2026-23646

Immediate Actions Required

• Upgrade OpenProject to version 16.6.5 or 17.0.1 immediately
• Review application logs for signs of session enumeration or mass session termination activity
• Alert users about potential unauthorized session terminations and advise password resets if compromise is suspected
• Consider temporarily restricting access to the OpenProject instance until patching is complete

Patch Information

OpenProject has released security patches addressing this vulnerability in versions 16.6.5 and 17.0.1. The patches implement proper authorization checks to ensure users can only delete sessions that belong to their own account.

• OpenProject Release v16.6.5
• OpenProject Release v17.0.1

For full technical details on the vulnerability and remediation, consult the GitHub Security Advisory GHSA-w422-xf8f-v4vp.

Workarounds

• No known workarounds are available for this vulnerability
• The vulnerability does not depend on specific permissions or features that can be temporarily disabled
• Applying the official patch is the only effective remediation

Organizations should prioritize upgrading to the patched versions as no configuration changes or temporary mitigations can address this authorization bypass vulnerability.