CVE-2026-44731

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-44731

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44731.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-44731

Aliases

GHSA-x7j3-cfgf-7mc4

Published

2026-06-26T19:41:53.550Z

Modified

2026-07-15T01:49:12.355807409Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

OpenProject: Improper Access Control on OpenProject through /projects/[projectName]/meetings via "invited_user_id" in GET parameter "filters" leads to user names disclosure

Details

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the web application's meetings filter feature leaks whether a given user ID corresponds to a valid account and discloses the user's full name, allowing an attacker to enumerate all existing user accounts by probing user IDs and observing differences in the server response. This vulnerability is fixed in 17.3.2 and 17.4.0.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44731.json",
    "cwe_ids": [
        "CWE-639"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/opf/openproject

Affected ranges

Type

GIT

Repo

https://github.com/opf/openproject

Events

Introduced

Fixed

cd0d46e68f91e27deeb1fd12511a646043612498

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "17.3.2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

11.*

11.2.1

2.*

2.4.0

Other

sprint/2014_08

sprint/2014_09

sprint/2014_10

sprint/2014_11

sprint/2014_12

sprint/2014_13

sprint/2014_16

sprint/2014_18

sprint/2015_01

sprint/2015_02

sprint/2015_03

sprint/2015_04

v10.*

v10.5

v17.*

v17.3.1

v5.*

v5.0.4

v9.*

v9.0.0-pre

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44731.json"