What is the CVSS score of CVE-2026-52784?

CVE-2026-52784 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of OpenProject are affected by CVE-2026-52784?

OpenProject vulnerability CVE-2026-52784 allows attackers to exploit cross-site request forgery (CSRF) against logged-in administrators to grant arbitrary accounts full administrative rights; no…. A patch is available.

How to fix or mitigate CVE-2026-52784?

Within 24 hours: Inventory all OpenProject deployments and identify current versions in the 17.3.x and 17.4.x lines. Within 7 days: Plan and schedule upgrades; patch 17.3.x instances to 17.3.3 and 17.4.x instances to 17.4.1, prioritizing production environments. Within 30 days: Complete all upgrades, verify patched versions, and confirm privilege escalation protections are active.

OpenProject CVE-2026-52784

EUVD-2026-39868 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-26 GitHub_M

CSRF Openproject Opf

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

CSRF needs the victim to load attacker content (UI:R) and the attacker holds no account (PR:N); abuse of the victim's admin session grants full admin, so C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 26, 2026 - 21:02 EUVD

Analysis Generated

Jun 26, 2026 - 19:47 vuln.today

DescriptionCVE.org

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is a CSRF on TARGET through /users/:id via POST parameter "user[admin]". This vulnerability is fixed in 17.3.3 and 17.4.1.

AnalysisAI

Privilege escalation in OpenProject before 17.3.3 and 17.4.1 lets an attacker forge a cross-site request to /users/:id carrying the POST parameter user[admin], coercing a logged-in privileged user's browser into granting administrator rights to an arbitrary account. The flaw (CWE-352) rates CVSS 8.8 because a successful forgery yields full administrative control over the instance; no public exploit is identified at time of analysis and it is not listed in CISA KEV. Both the 17.3.x and 17.4.x maintenance lines are affected, with fixes shipped in 17.3.3 and 17.4.1.

Technical ContextAI

OpenProject is a Ruby on Rails based open-source web project-management platform (CPE cpe:2.3:a:opf:openproject). The root cause is CWE-352 Cross-Site Request Forgery: the user-update endpoint /users/:id accepts a state-changing POST that toggles the user[admin] attribute without an effective anti-CSRF token check on that path, so a request originating from an attacker-controlled page is processed using the victim's authenticated session cookies. Because the mutable attribute is the administrator flag itself, the missing CSRF protection translates directly into an authorization boundary bypass rather than a benign data change.

RemediationAI

Vendor-released patch: upgrade to OpenProject 17.3.3 (for 17.3.x deployments) or 17.4.1 (for 17.4.x deployments), per advisory GHSA-6crw-7f5r-4qj9 (https://github.com/opf/openproject/security/advisories/GHSA-6crw-7f5r-4qj9). Where immediate patching is not possible, compensating controls include enforcing SameSite=Lax or Strict and Secure attributes on the session cookie so cross-origin POSTs do not carry credentials (side effect: may break legitimate cross-site embeds or SSO flows), and fronting OpenProject with a reverse proxy or WAF rule that rejects POSTs to /users/:id lacking an Origin/Referer matching the deployment host (side effect: can break clients that strip Referer). Additionally instruct administrators and operators to avoid browsing untrusted sites within an active OpenProject session and to log out when idle, reducing the window for a forged request.