Medium severity · published Feb 9, 2026
CVE-2026-24777
OpenProject has Improper Access Control on User Management allows user managers to lock admin accounts
6.7
CVSS
0.4%
EPSS
No
On KEV
Description
OpenProject is an open-source, web-based project management software. Prior to 17.0.2, users with the Manage Users permission can lock and unlock users. This functionality should only be possible for users of the application, but they were not supposed to be able to lock application administrators. Due to a missing permission check this logic was not enforced. The problem was fixed in OpenProject 17.0.2The problem was fixed in OpenProject 17.0.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openproject · opf
< 17.0.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24777
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24777
Release Notes
https://github.com/opf/openproject/releases/tag/v17.0.2
Vendor Advisory
https://github.com/opf/openproject/security/advisories/GHSA-fq66-cwg6-qq69
More from openproject
9.9
CVE-2026-46386
OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`
9.9
CVE-2026-52782
OpenProject: IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[project_folder_id]" leads to Access to Unauthorized Resources
9.9
CVE-2026-52785
OpenProject: SQL injection in timestamps functionality
9.9
CVE-2026-25763
Command Injection on OpenProject repositories leads to Remote Code Execution
9.6
CVE-2026-52780
OpenProject: Cache store poisoning leads to Remote Code Execution (RCE)