CVE-2026-23646 (CNNVD-202601-3024)
中文标题:
OpenProject 安全漏洞
英文标题:
OpenProject users can delete other user's session, causing them to be logged out
漏洞描述
中文描述:
OpenProject是OpenProject开源的一个基于Web的项目管理软件。 OpenProject 16.6.5之前版本和17.0.1之前版本存在安全漏洞，该漏洞源于删除会话时未验证会话所属用户，可能导致未经身份验证的用户终止其他用户的会话。
英文描述:
OpenProject is an open-source, web-based project management software. Users of OpenProject versions prior to 16.6.5 and 17.0.1 have the ability to view and end their active sessions via Account Settings → Sessions. When deleting a session, it was not properly checked if the session belongs to the user. As the ID that is used to identify these session objects use incremental integers, users could iterate requests using `DELETE /my/sessions/:id` and thus unauthenticate other users. Users did not have access to any sensitive information (like browser identifier, IP addresses, etc) of other users that are stored in the session. The problem was patched in OpenProject versions 16.6.5 and 17.0.1. No known workarounds are available as this does not require any permissions or other that can temporarily be disabled.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| opf | openproject | < 16.6.5 | - | - |
cpe:2.3:a:opf:openproject:<_16.6.5:*:*:*:*:*:*:*
|
| opf | openproject | = 17.0.0 | - | - |
cpe:2.3:a:opf:openproject:=_17.0.0:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.1 (cna)
MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2026-23646 |
2026-01-20 02:19:58 | 2026-01-19 19:10:35 |
| NVD | nvd_CVE-2026-23646 |
2026-01-20 03:00:05 | 2026-01-19 19:10:38 |
| CNNVD | cnnvd_CNNVD-202601-3024 |
2026-01-26 02:10:03 | 2026-01-25 18:11:53 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202601-3024
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']