CVE-2026-23646 OpenProject users can delete other user's session, causing them to be logged out
Authenticated users can forcibly log out other users by deleting their sessions due to missing ownership checks on session IDs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-23646?
CVE-2026-23646 is a medium-severity missing authorization vulnerability in opf openproject, published on 19 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenProject is an open-source, web-based project management software. Users of OpenProject versions prior to 16.6.5 and 17.0.1 have the ability to view and end their active sessions via Account Settings → Sessions. When deleting a session, it was not properly checked if the session belongs to the user. As the ID that is used to identify these session objects use incremental integers, users could iterate requests using `DELETE /my/sessions/:id` and thus unauthenticate other users. Users did not have access to any sensitive information (like browser identifier, IP addresses, etc) of other users that are stored in the session. The problem was patched in OpenProject versions 16.6.5 and 17.0.1. No known workarounds are available as this does not require any permissions or other that can temporarily be disabled.
Weakness: CWE-488
Which versions are affected by CVE-2026-23646?
It affects 1 product.
Products include Openproject Openproject.
How do I fix CVE-2026-23646?
No fix has been published for CVE-2026-23646 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-23646 being exploited?
There is no known exploitation of CVE-2026-23646 in the wild and no public exploit code.
Other vulnerabilities in opf openproject
- CVE-2026-34717 OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string
- CVE-2026-25763 Command Injection on OpenProject repositories leads to Remote Code Execution
- CVE-2026-24685 OpenProject has Argument Injection on Repository module that allows Arbitrary File Write
- CVE-2026-32698 OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution
- CVE-2026-32703 OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policy
Sources
Also known as GHSA-w422-xf8f-v4vp.