{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A4530571-3A78-40BB-9B33-880974D8C7CF",
              "versionEndExcluding": "17.0.2",
              "versionStartIncluding": "17.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenProject is an open-source, web-based project management software. To enable the real time collaboration on documents, OpenProject 17.0 introduced a synchronization server. The OpenPrioject backend generates an authentication token that is currently valid for 24 hours, encrypts it with a shared secret only known to the synchronization server. The frontend hands this encrypted token and the backend URL over to the synchronization server to check user\u0027s ability to work on the document and perform intermittent saves while editing. The synchronization server does not properly validate the backend URL and sends a request with the decrypted authentication token to the endpoint that was given to the server. An attacker could use this vulnerability to decrypt a token that he intercepted by other means to gain an access token to interact with OpenProject on the victim\u0027s behalf. This vulnerability was introduced with OpenProject 17.0.0 and was fixed in 17.0.2. As a workaround, disable the collaboration feature via Settings -\u003e Documents -\u003e Real time collaboration -\u003e Disable. Additionally the `hocuspocus` container should also be disabled."
    },
    {
      "lang": "es",
      "value": "OpenProject es un software de gesti\u00f3n de proyectos de c\u00f3digo abierto y basado en la web. Para habilitar la colaboraci\u00f3n en tiempo real en documentos, OpenProject 17.0 introdujo un servidor de sincronizaci\u00f3n. El backend de OpenProject genera un token de autenticaci\u00f3n que actualmente es v\u00e1lido por 24 horas, lo cifra con un secreto compartido conocido solo por el servidor de sincronizaci\u00f3n. El frontend entrega este token cifrado y la URL del backend al servidor de sincronizaci\u00f3n para verificar la capacidad del usuario para trabajar en el documento y realizar guardados intermitentes durante la edici\u00f3n. El servidor de sincronizaci\u00f3n no valida correctamente la URL del backend y env\u00eda una solicitud con el token de autenticaci\u00f3n descifrado al endpoint que se le dio al servidor. Un atacante podr\u00eda usar esta vulnerabilidad para descifrar un token que intercept\u00f3 por otros medios para obtener un token de acceso para interactuar con OpenProject en nombre de la v\u00edctima. Esta vulnerabilidad fue introducida con OpenProject 17.0.0 y fue corregida en 17.0.2. Como soluci\u00f3n alternativa, deshabilite la funci\u00f3n de colaboraci\u00f3n a trav\u00e9s de Configuraci\u00f3n -\u0026gt; Documentos -\u0026gt; Colaboraci\u00f3n en tiempo real -\u0026gt; Deshabilitar. Adem\u00e1s, el contenedor \u0027hocuspocus\u0027 tambi\u00e9n deber\u00eda deshabilitarse."
    }
  ],
  "id": "CVE-2026-24772",
  "lastModified": "2026-02-12T20:41:11.210",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 8.9,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-01-28T19:16:24.763",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/opf/openproject/security/advisories/GHSA-r854-p5qj-x974"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}