What is the CVSS score of CVE-2026-24772?

CVE-2026-24772 has a CVSS 3.1 base score of 8.9 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Openproject are affected by CVE-2026-24772?

OpenProject versions 17.0 and later contain a critical vulnerability (CVSS 8.9) in the real-time document collaboration synchronization server that could allow attackers to compromise project data…

How to fix or mitigate CVE-2026-24772?

Within 24 hours: Inventory all OpenProject 17.0+ instances and assess exposure; isolate affected systems from untrusted networks if possible. Within 7 days: Implement network segmentation to restrict synchronization server access, monitor for suspicious activity, and establish communication plan with stakeholders. Within 30 days: Evaluate alternative project management solutions; contact OpenProject vendor for patch ETA and interim security updates; perform security audit of affected systems.

Openproject CVE-2026-24772

HIGH

Insufficient Verification of Data Authenticity (CWE-345)

2026-01-28 security-advisories@github.com

Authentication Bypass Openproject

8.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.9 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 28, 2026 - 19:16 nvd

HIGH 8.9

DescriptionGitHub Advisory

OpenProject is an open-source, web-based project management software. To enable the real time collaboration on documents, OpenProject 17.0 introduced a synchronization server. The OpenPrioject backend generates an authentication token that is currently valid for 24 hours, encrypts it with a shared secret only known to the synchronization server. The frontend hands this encrypted token and the backend URL over to the synchronization server to check user's ability to work on the document and perform intermittent saves while editing. The synchronization server does not properly validate the backend URL and sends a request with the decrypted authentication token to the endpoint that was given to the server. An attacker could use this vulnerability to decrypt a token that he intercepted by other means to gain an access token to interact with OpenProject on the victim's behalf. This vulnerability was introduced with OpenProject 17.0.0 and was fixed in 17.0.2. As a workaround, disable the collaboration feature via Settings -> Documents -> Real time collaboration -> Disable. Additionally the hocuspocus container should also be disabled.

AnalysisAI

Token decryption in OpenProject 17.0 allows authenticated attackers to intercept and decrypt 24-hour authentication tokens by exploiting insufficient validation of backend URLs in the real-time collaboration synchronization server. An attacker with valid credentials could redirect the synchronization server to a controlled endpoint, forcing it to send the decrypted token and enabling unauthorized access to document collaboration features. No patch is currently available for this high-severity vulnerability affecting authenticated users.

Technical ContextAI

Classified as CWE-345 (Insufficient Verification of Data Authenticity). Affects Openproject. OpenProject is an open-source, web-based project management software. To enable the real time collaboration on documents, OpenProject 17.0 introduced a synchronization server. The OpenPrioject backend generates an authentication token that is currently valid for 24 hours, encrypts it with a shared secret only known to the synchronization server. The frontend hands this encrypted token and the backend URL over to the synchronization server to check user's ability to work on the document and perfo