Security readout for executives and security teams
Plain-English summary
CVE-2026-22604 lets an unauthenticated person discover usernames on vulnerable OpenProject instances through the change-password workflow. This does not expose passwords or modify data, but it can aid phishing, credential stuffing, and targeted login attacks. OpenProject fixed the issue in version 16.6.2.
Executive priority
Treat as a timely patching item, especially for public OpenProject sites. The vulnerability is not known to be actively exploited, but it lowers the barrier for targeted account attacks. Upgrade during the next appropriate maintenance window, faster if the system is internet-facing.
Technical view
OpenProject versions 11.2.1 through before 16.6.2 expose usernames when the unauthenticated /account/change_password endpoint receives an arbitrary password_change_user_id value. The error page reveals the corresponding username, enabling account enumeration. The issue is classified as CWE-200 with CVSS 4.0 score 6.9.
Likely exposure
Internet-facing OpenProject deployments are the primary concern because the affected endpoint is intended to be reachable without authentication. Instances running versions 11.2.1 to before 16.6.2 are affected. Internal-only deployments still have exposure to insider or compromised-network enumeration.
Exploitation context
The source bundle does not indicate active exploitation, and this CVE is not listed as CISA KEV. Exploitation requires network access but no authentication, user interaction, or special conditions according to the CVSS vector. The practical impact is information disclosure that can support follow-on attacks.
Researcher notes
The advisory identifies a username disclosure flaw in the unauthenticated password-change path. The fix is linked through the OpenProject advisory, pull request, commit, and 16.6.2 release. Evidence supports affected version range and patch version; no source in the bundle confirms exploitation in the wild.
Mitigation direction
- Upgrade OpenProject to version 16.6.2 or later.
- Prioritize internet-facing OpenProject instances.
- Review OpenProject’s security advisory and release notes for deployment-specific guidance.
- Monitor authentication logs for unusual username probing or failed login patterns.
Validation and detection
- Inventory OpenProject instances and record exact versions.
- Confirm affected systems are not between 11.2.1 and before 16.6.2.
- Verify upgraded systems report OpenProject 16.6.2 or later.
- Check change-password error handling no longer discloses usernames.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-200: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-22604 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
6.9MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/opf/openproject/security/advisories/GHSA-q7qp-p3vw-j2fhCVE reference · x_refsource_CONFIRM
- https://github.com/opf/openproject/pull/3451CVE reference · x_refsource_MISC
- https://github.com/opf/openproject/commit/2cff5e98649e32a197a62659a23dd4b864b7855bCVE reference · x_refsource_MISC
- https://github.com/opf/openproject/releases/tag/v16.6.2CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.