CVE-2026-44731: OpenProject Information Disclosure Flaw

CVE-2026-44731 Overview

CVE-2026-44731 is an information disclosure vulnerability in OpenProject, an open-source web-based project management platform. The meetings filter feature leaks whether a supplied user ID maps to a valid account and returns the associated user's full name. An authenticated attacker can iterate through user IDs and observe differences in server responses to enumerate every account in the instance. The issue is tracked under CWE-639: Authorization Bypass Through User-Controlled Key and affects OpenProject versions prior to 17.3.2 and 17.4.0.

Critical Impact
Authenticated attackers can enumerate all OpenProject accounts and harvest full names, enabling targeted phishing, credential stuffing, and social engineering campaigns.

Affected Products

OpenProject versions prior to 17.3.2
OpenProject 17.4.0 pre-release builds
Self-hosted and cloud deployments exposing the meetings module

Discovery Timeline

2026-06-26 - CVE-2026-44731 published to the National Vulnerability Database
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-44731

Vulnerability Analysis

The vulnerability resides in the OpenProject meetings filter feature. When a client submits a filter request that references a user ID, the server treats the identifier as a user-controlled key without enforcing consistent authorization or response normalization. Valid identifiers return the corresponding user's full name in the filter response, while invalid identifiers produce a distinguishable response. This behavioral asymmetry provides an oracle for account enumeration.

Exploitation requires only low-privilege authenticated access. The attacker does not need administrative rights or user interaction from victims. The impact is limited to confidentiality of user identity data; integrity and availability of the platform are not affected. Enumerated account lists become inputs to downstream attacks such as password spraying, targeted phishing, and business email compromise.

Root Cause

The meetings filter endpoint fails to apply uniform authorization checks and identical response semantics for existing versus non-existing user IDs. Under CWE-639, the application uses a client-supplied key to look up sensitive data without verifying that the caller is entitled to learn whether that key resolves to a real user. The disclosure of the user's full name compounds the issue by returning personally identifying information alongside the existence signal.

Attack Vector

An authenticated attacker sends sequential filter queries to the meetings endpoint, iterating through numeric user identifiers. The attacker compares response bodies, status codes, or timing between requests that reference valid and invalid IDs. Automated scripting can enumerate the entire user directory within minutes on a typical deployment. See the OpenProject GitHub Security Advisory GHSA-x7j3-cfgf-7mc4 for advisory details.

Detection Methods for CVE-2026-44731

Indicators of Compromise

Sequential or high-volume requests to the meetings filter endpoint referencing incrementing user ID parameters from a single session or IP.
Anomalous outbound traffic from an authenticated low-privilege account harvesting user metadata.
Access logs showing enumeration patterns followed by targeted authentication attempts against enumerated accounts.

Detection Strategies

Parse OpenProject application logs for filter requests that iterate user ID parameters in a short time window.
Correlate authenticated session activity with request-rate thresholds against the meetings module.
Establish behavioral baselines for filter endpoint usage per account role and alert on deviations.

Monitoring Recommendations

Enable verbose access logging on the OpenProject web tier and forward logs to a centralized analytics platform.
Monitor authentication logs for password spraying or credential stuffing that follows filter enumeration activity.
Track newly created low-privilege accounts that immediately generate filter traffic against user identifiers.

How to Mitigate CVE-2026-44731

Immediate Actions Required

Upgrade OpenProject to version 17.3.2 or 17.4.0 without delay.
Audit application access logs for prior enumeration attempts against the meetings filter endpoint.
Rotate credentials for accounts exposed via enumeration if follow-on authentication abuse is suspected.

Patch Information

OpenProject fixed CVE-2026-44731 in versions 17.3.2 and 17.4.0. The remediation aligns the meetings filter authorization checks and normalizes responses so that valid and invalid user IDs cannot be distinguished by unauthorized callers. Refer to the OpenProject GitHub Security Advisory GHSA-x7j3-cfgf-7mc4 for the full patch changelog.

Workarounds

Restrict access to the OpenProject instance behind a VPN or identity-aware proxy to limit the pool of authenticated attackers.
Apply web application firewall rules that rate-limit requests to the meetings filter endpoint per authenticated session.
Disable or restrict access to the meetings module for low-privilege roles until patching is complete.

bash

# Example nginx rate-limit for the meetings filter endpoint
limit_req_zone $binary_remote_addr zone=meetings_filter:10m rate=10r/m;

location /meetings {
    limit_req zone=meetings_filter burst=5 nodelay;
    proxy_pass http://openproject_upstream;
}