CVE-2026-44733: OpenProject Auth Bypass Vulnerability

CVE-2026-44733 Overview

CVE-2026-44733 is a business logic flaw in OpenProject, an open-source web-based project management platform. Versions prior to 17.3.2 and 17.4.0 improperly validate password requirements when a PATCH request is sent to the /api/v3/users/me endpoint. The flaw allows an attacker with an active authenticated session to change a target user's password without satisfying standard password validation controls. Exploitation requires session takeover, limiting the practical attack surface. The issue is tracked under [CWE-620: Unverified Password Change] and is fixed in OpenProject 17.3.2 and 17.4.0.

Critical Impact
Attackers with an active session takeover can change a user's password by bypassing password validation logic through the /api/v3/users/me API endpoint.

Affected Products

OpenProject versions prior to 17.3.2
OpenProject versions prior to 17.4.0
OpenProject API endpoint /api/v3/users/me

Discovery Timeline

2026-06-26 - CVE-2026-44733 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-44733

Vulnerability Analysis

The vulnerability is a business logic error in OpenProject's user profile update workflow. When a client sends a PATCH request to /api/v3/users/me, the endpoint accepts a password change without enforcing the same validation checks required by the standard password change flow. Normal password change operations require the user to supply the current password and pass validation policies. The PATCH handler skips or misapplies these checks, allowing the password field to be updated using only the authenticated session context.

Root Cause

The root cause is missing verification of the existing password during the profile update code path, categorized as [CWE-620: Unverified Password Change]. The /api/v3/users/me handler treats the password attribute as any other editable profile field. It does not re-authenticate the requester or require the old password before persisting a new credential value. This design assumption breaks the security boundary that normally protects account credentials.

Attack Vector

Exploitation requires an attacker to already control an active authenticated session belonging to the victim. This can result from session hijacking, cross-site scripting on a trusted origin, stolen cookies, or a compromised browser. Once the attacker has session context, they issue a single PATCH request to /api/v3/users/me containing a new password value. The server accepts the change and the attacker gains persistent access to the account, surviving session invalidation. The high attack complexity reflects the prerequisite of session takeover rather than a direct remote credential attack.

No verified proof-of-concept code is publicly available. See the GitHub Security Advisory GHSA-px7f-cj9f-7m4m for vendor technical details.

Detection Methods for CVE-2026-44733

Indicators of Compromise

Unexpected PATCH requests to /api/v3/users/me containing a password field in the JSON body.
Password change events in OpenProject audit logs without a corresponding legitimate user password reset workflow.
User account lockouts or complaints of lost access following API activity from unfamiliar IP addresses or user agents.

Detection Strategies

Inspect web server and reverse proxy logs for PATCH /api/v3/users/me requests and correlate with the source IP, session identifier, and user agent.
Alert on password modifications that occur through the API path rather than the standard /my/password change form.
Correlate session creation events with subsequent password changes occurring within short time windows to identify session takeover patterns.

Monitoring Recommendations

Enable and centralize OpenProject application and audit logs in a SIEM for retention and correlation.
Monitor for anomalous authentication patterns such as concurrent sessions from geographically distant IP addresses.
Track API rate and endpoint usage baselines for /api/v3/users/me to detect deviations.

How to Mitigate CVE-2026-44733

Immediate Actions Required

Upgrade OpenProject to version 17.3.2 or 17.4.0, which contain the fix for CVE-2026-44733.
Invalidate all active user sessions after patching to force re-authentication and evict any hijacked sessions.
Review audit logs for suspicious PATCH requests to /api/v3/users/me and reset passwords for any impacted accounts.

Patch Information

The vendor released fixes in OpenProject 17.3.2 and 17.4.0. Administrators should apply the upgrade following the standard OpenProject upgrade procedure. Refer to the GitHub Security Advisory GHSA-px7f-cj9f-7m4m for release notes and remediation guidance.

Workarounds

Restrict access to the OpenProject API at the network layer where feasible until patches are applied.
Enforce short session lifetimes and require re-authentication for sensitive account changes.
Deploy web application firewall rules that inspect PATCH requests to /api/v3/users/me and block payloads containing a password attribute from untrusted sources.

bash

# Example WAF rule concept (ModSecurity)
SecRule REQUEST_METHOD "@streq PATCH" \
    "chain,phase:2,deny,status:403,id:1044733,\
    msg:'Block password change via /api/v3/users/me (CVE-2026-44733)'"
    SecRule REQUEST_URI "@streq /api/v3/users/me" "chain"
        SecRule REQUEST_BODY "@rx \"password\"\s*:" "t:none"