CVE-2026-44731

Beschreibung

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the web application-s meetings filter feature leaks whether a given user ID corresponds to a valid account and discloses the user-s full name, allowing an attacker to enumerate all existing user accounts by probing user IDs and observing differences in the server response. This vulnerability is fixed in 17.3.2 and 17.4.0.