What is the CVSS score of CVE-2026-44731?

CVE-2026-44731 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-44731?

Yes, a patch is available for CVE-2026-44731. Update the affected software to the latest version immediately.

OpenProject CVE-2026-44731

EUVD-2026-39860 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-26 GitHub_M

Authentication Bypass Openproject Opf

4.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable web endpoint (AV:N/AC:L), authenticated session required (PR:L), impact limited to partial disclosure of user account existence and full names (C:L/I:N/A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 26, 2026 - 21:02 EUVD

Analysis Generated

Jun 26, 2026 - 20:37 vuln.today

DescriptionCVE.org

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the web application's meetings filter feature leaks whether a given user ID corresponds to a valid account and discloses the user's full name, allowing an attacker to enumerate all existing user accounts by probing user IDs and observing differences in the server response. This vulnerability is fixed in 17.3.2 and 17.4.0.

AnalysisAI

User account enumeration in OpenProject's meetings filter feature allows authenticated attackers to probe arbitrary user IDs and, by observing differences in server responses, determine whether each ID corresponds to a valid account and retrieve the associated user's full name. All versions prior to 17.3.2 and 17.4.0 are affected. No public exploit code or active exploitation has been identified at time of analysis, though the low-complexity attack path makes this straightforward to weaponize for reconnaissance.

Technical ContextAI

CWE-639 (Authorization Bypass Through User-Controlled Key) describes a class of flaws where an application uses attacker-controlled keys - here, numeric user IDs - to reference internal objects without validating whether the requesting user is authorized to observe the referenced object's existence or attributes. OpenProject is a web-based, open-source project management platform (CPE: cpe:2.3:a:opf:openproject:*:*:*:*:*:*:*:*). Its meetings filter feature accepts user ID parameters and returns distinct responses depending on whether the supplied ID maps to a real account, unintentionally leaking both account existence and the user's full name. This is a classic IDOR-adjacent information disclosure rooted in missing authorization checks on a filter endpoint.

RemediationAI

Upgrade to OpenProject 17.3.2 (patch release) or 17.4.0 (minor release), as confirmed by the vendor advisory at https://github.com/opf/openproject/security/advisories/GHSA-x7j3-cfgf-7mc4. If an immediate upgrade is not possible, consider restricting access to the meetings filter endpoint at the network or application layer to trusted internal IP ranges, accepting the trade-off that this may degrade meeting scheduling functionality for remote users. Additionally, review and restrict which roles can access the meetings module to reduce the pool of potential attackers - limiting the meetings feature to specific user groups reduces exposure but does not eliminate the underlying flaw. No patch-free workaround fully mitigates the vulnerability.