Security readout for executives and security teams
Plain-English summary
OpenProject 17.0 added real-time document collaboration using a Hocuspocus synchronization server. A validation flaw can let an authenticated attacker misuse an intercepted encrypted token and backend URL handling to obtain an access token for a victim. Fixed versions are available. Organizations using OpenProject 17.0.0 or 17.0.1 with collaboration enabled should prioritize remediation.
Executive priority
Treat as urgent for affected OpenProject 17.0 deployments with collaboration enabled. The flaw can enable victim-level access if prerequisites are met. Patch to 17.0.2 or disable collaboration and Hocuspocus until patched. No active exploitation is confirmed in the supplied sources.
Technical view
CVE-2026-24772 affects OpenProject >=17.0.0 and <17.0.2, including openproject/hocuspocus <17.0.2. The synchronization server insufficiently validates a backend URL, then sends a decrypted authentication token to the supplied endpoint. The advisory describes SSRF and CSWSH impacts. CVSS is 8.9, with low attack complexity, required privileges, required user interaction, and high confidentiality and integrity impact.
Likely exposure
Exposure is likely limited to OpenProject deployments on 17.0.0 or 17.0.1 using the real-time collaboration feature and Hocuspocus synchronization server. Deployments below 17.0.0 are not described as affected by the source. Version 17.0.2 is listed as fixed.
Exploitation context
The CVE record does not indicate CISA KEV listing, and the provided sources do not report active exploitation. Exploitation requires attacker privileges, user interaction, and token interception by other means, according to the description. Business risk is impersonation of a victim inside OpenProject and potential data access or modification.
Researcher notes
The public description centers on improper backend URL validation and token forwarding by the Hocuspocus synchronization server. CWE is listed as CWE-345. The source bundle does not provide exploit details, indicators of compromise, or evidence of active exploitation. Validate exposure through version, feature state, and container deployment.
Mitigation direction
- Upgrade OpenProject and openproject/hocuspocus to version 17.0.2 or later.
- If upgrade is delayed, disable real-time collaboration in OpenProject document settings.
- Also disable the hocuspocus container when using the workaround.
- Review the vendor advisory for any deployment-specific guidance.
Validation and detection
- Inventory OpenProject deployments and identify versions 17.0.0 and 17.0.1.
- Check whether real-time document collaboration is enabled.
- Confirm whether the hocuspocus container is running.
- Verify upgraded systems report OpenProject and hocuspocus version 17.0.2 or later.
- Review logs for unusual synchronization-server backend URL activity where available.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-345: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCloud metadata behavior lookup
The CVE wording references SSRF or metadata access, so cloud discovery and credential material review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-24772 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L2.36Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.9HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/opf/openproject/security/advisories/GHSA-r854-p5qj-x974CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Insufficient Verification of Data Authenticity
Insufficient Verification of Data Authenticity represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.