OpenProject EUVD-2026-39868

Exploitation targets the /users/:id update endpoint and specifically requires the forged request to set the POST parameter user[admin], so the precondition is that a victim with rights to modify user accounts (an existing administrator) has an active authenticated OpenProject session in a browser that loads the attacker's page. Limiting factors: the attack only succeeds against unpatched instances below 17.3.3 / 17.4.1, depends on luring a sufficiently-privileged user (the forged request runs with the victim's authority, not the attacker's), and is defeated if the deployment enforces SameSite session cookies or Origin/Referer validation. The published vector's UI:N is questionable because a CSRF inherently needs the victim to load attacker content; verify the user-interaction assumption with the vendor advisory.

The supplied CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) is internally inconsistent with a CSRF weakness: classic CSRF requires the victim to load attacker content, which should be UI:R, and the attacker themselves usually holds no account (PR:N) while abusing the victim's session - so the published UI:N/PR:L pairing should be verified against the GHSA advisory rather than trusted at face value. The high-impact triad (C:H/I:H/A:H) is plausible because the granted privilege is full admin. EPSS data was not provided, the CVE is not in CISA KEV, and no POC is referenced, so this is a real but not actively-exploited issue - prioritize based on exposure of admin/operator sessions rather than mass-exploitation signals. Net: a genuinely high-impact authorization flaw whose real-world exploitation hinges on social-engineering a privileged user, which tempers the raw 8.8 score.

An attacker hosts a web page with a hidden auto-submitting form that POSTs to https://victim-openproject/users/<attacker_account_id> with user[admin]=1, then lures a currently-logged-in OpenProject administrator to that page; the victim's browser submits the request with their session cookies and the attacker's account is silently elevated to administrator. No public proof-of-concept is identified at time of analysis, and the low attack complexity means a working forge is trivial to build once the endpoint behavior is known.