CVE-2026-24777

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-24777

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24777.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-24777

Aliases

GHSA-fq66-cwg6-qq69

Published

2026-02-09T18:28:45.146Z

Modified

2026-07-08T06:13:40.036063150Z

Severity

6.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H CVSS Calculator

Summary

OpenProject has Improper Access Control on User Management allows user managers to lock admin accounts

Details

OpenProject is an open-source, web-based project management software. Prior to 17.0.2, users with the Manage Users permission can lock and unlock users. This functionality should only be possible for users of the application, but they were not supposed to be able to lock application administrators. Due to a missing permission check this logic was not enforced. The problem was fixed in OpenProject 17.0.2The problem was fixed in OpenProject 17.0.2.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24777.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-862"
    ]
}

References

Affected packages

Git / github.com/opf/openproject

Affected ranges

Type

GIT

Repo

https://github.com/opf/openproject

Events

Introduced

Fixed

87a8cdc7632de8ab06475ba373fd354e0be30e2a

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "17.0.2"
        }
    ]
}

Affected versions

v17.*

v17.0.0

v17.0.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24777.json"