CVE-2026-52784: OpenProject CSRF Vulnerability

CVE-2026-52784 Overview

CVE-2026-52784 is a Cross-Site Request Forgery (CSRF) vulnerability in OpenProject, an open-source web-based project management platform. The flaw affects versions prior to 17.3.3 and 17.4.1. Attackers exploit the vulnerability by tricking an authenticated administrator into submitting a crafted request to the /users/:id endpoint. The request sets the user[admin] POST parameter, granting administrator privileges to an attacker-controlled account. The issue is tracked under [CWE-352] (Cross-Site Request Forgery) and is fixed in versions 17.3.3 and 17.4.1.

Critical Impact
Successful exploitation grants attackers full administrative control over the OpenProject instance, exposing all projects, users, and sensitive data.

Affected Products

OpenProject versions prior to 17.3.3
OpenProject versions prior to 17.4.1 (17.4.x branch)
Self-hosted and containerized OpenProject deployments

Discovery Timeline

2026-06-26 - CVE-2026-52784 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-52784

Vulnerability Analysis

The vulnerability exists in OpenProject's user management endpoint at /users/:id. The endpoint accepts a POST request containing the user[admin] parameter, which controls whether a user account holds administrator rights. The application fails to validate a CSRF token on this request. As a result, any authenticated administrator visiting an attacker-controlled page can be forced to submit a request that elevates a target user account to administrator.

The attack requires the victim to be an authenticated OpenProject administrator with an active session. The attacker hosts a malicious page containing an auto-submitting form or fetch request targeting the vulnerable endpoint. When the administrator loads the page, the browser sends the request with session cookies attached, and the server processes the privilege change.

Root Cause

The root cause is missing or improperly enforced CSRF token validation on the user update endpoint. State-changing operations must verify that the request originated from a legitimate application context. The /users/:id handler processes admin-flag modifications based solely on the session cookie, allowing forged cross-origin requests to succeed.

Attack Vector

The vulnerability is exploited over the network with low attack complexity. The attacker crafts an HTML page containing a form or JavaScript request that POSTs to the victim OpenProject instance at /users/:id with user[admin]=true. When an authenticated administrator visits the page, the browser attaches session cookies, and the request modifies the targeted user record. The attacker then logs in with the elevated account and gains full control of the platform. See the OpenProject GitHub Security Advisory for additional technical detail.

Detection Methods for CVE-2026-52784

Indicators of Compromise

Unexpected changes to the admin flag on user records in the OpenProject database.
POST requests to /users/:id originating from external Referer or Origin headers.
New administrator accounts or privilege escalations not correlated with legitimate admin actions in audit logs.

Detection Strategies

Review OpenProject application logs for POST requests to /users/:id containing the user[admin] parameter.
Correlate user privilege changes with authenticated admin session activity to detect requests initiated from external origins.
Alert on any request to user management endpoints where the Origin or Referer header does not match the OpenProject application domain.

Monitoring Recommendations

Enable and retain OpenProject audit logs for all user record modifications.
Monitor web application firewall (WAF) logs for cross-origin POST requests targeting /users/.
Track administrator role assignments and trigger alerts when the total number of admins changes unexpectedly.

How to Mitigate CVE-2026-52784

Immediate Actions Required

Upgrade OpenProject to version 17.3.3 or 17.4.1 immediately.
Audit all administrator accounts and remove any unauthorized privilege assignments.
Force session invalidation for all administrators after patching to eliminate any active hijacked sessions.
Rotate API tokens and credentials associated with administrator accounts.

Patch Information

OpenProject released fixed versions 17.3.3 and 17.4.1. Both versions add CSRF token enforcement on the affected user update endpoint. Administrators should follow standard upgrade procedures documented by OpenProject and validate the version after deployment. Refer to the OpenProject GHSA-6crw-7f5r-4qj9 advisory for release notes and upgrade guidance.

Workarounds

Restrict access to the OpenProject administrative interface using network-level controls or a VPN until patching is complete.
Configure a reverse proxy or WAF to reject POST requests to /users/:id that lack a matching Origin or Referer header.
Instruct administrators to use dedicated browsers or isolated sessions when accessing OpenProject to reduce CSRF exposure.

bash

# Example nginx rule to block cross-origin POSTs to the vulnerable endpoint
location ~ ^/users/[0-9]+$ {
    if ($request_method = POST) {
        if ($http_origin !~* ^https://openproject\.example\.com$) {
            return 403;
        }
    }
    proxy_pass http://openproject_backend;
}