CVE Explorer

CVE-2026-24772

OpenProject is an open-source, web-based project management software. To enable the real time collaboration on documents, OpenProject 17.0 introduced a synchronization server. The OpenPrioject backend generates an authentication token that is currently valid for 24 hours, encrypts it with a shared secret only known to the synchronization server. The frontend hands this encrypted token and the backend URL over to the synchronization server to check user's ability to work on the document and perfo

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:791aebd99f02898152fa640ec1506bf87d73b133d22566448962ddb0e5531dcc

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"openproject","vendor":"opf","versions":[{"status":"affected","version":"OpenProject >= 17.0.0, < 17.0.2"},{"status":"affected","version":"openproject/hocuspocus < 17.0.2"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:8bd80ce16c7e79add3c7f35096c3f51af264c824a0c2d9c8e9da2326da4b4550 · sha256:27513935d95d6c1e… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.9,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:8bd80ce16c7e79add3c7f35096c3f51af264c824a0c2d9c8e9da2326da4b4550 · sha256:27513935d95d6c1e… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-345","description":"CWE-345: Insufficient Verification of Data Authenticity","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:8bd80ce16c7e79add3c7f35096c3f51af264c824a0c2d9c8e9da2326da4b4550 · sha256:27513935d95d6c1e… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion

{"name":"https://github.com/opf/openproject/security/advisories/GHSA-r854-p5qj-x974","tags":["x_refsource_CONFIRM"],"url":"https://github.com/opf/openproject/security/advisories/GHSA-r854-p5qj-x974"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:8bd80ce16c7e79add3c7f35096c3f51af264c824a0c2d9c8e9da2326da4b4550 · sha256:27513935d95d6c1e… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer