CVE-2026-44731

{
  "id": "CVE-2026-44731",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-26T20:17:02.943",
  "lastModified": "2026-10-25T17:10:00.197",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the web application's meetings filter feature leaks whether a given user ID corresponds to a valid account and discloses the user's full name, allowing an attacker to enumerate all existing user accounts by probing user IDs and observing differences in the server response. This vulnerability is fixed in 17.3.2 and 17.4.0."
    },
    {
      "lang": "es",
      "value": "OpenProject es un software de gestión de proyectos de código abierto y basado en la web. Antes de las versiones 17.3.2 y 17.4.0, la función de filtro de reuniones de la aplicación web expone si un ID de usuario dado corresponde a una cuenta válida y revela el nombre completo del usuario, permitiendo a un atacante enumerar todas las cuentas de usuario existentes al sondear IDs de usuario y observar diferencias en la respuesta del servidor. Esta vulnerabilidad está corregida en las versiones 17.3.2 y 17.4.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "opf",
          "product": "openproject",
          "versions": [
            {
              "version": "< 17.3.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-29T13:22:22.273307Z",
          "id": "CVE-2026-44731",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/opf/openproject/security/advisories/GHSA-x7j3-cfgf-7mc4",
      "source": "[email protected]"
    }
  ]
}