CVE-2026-22602

OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, a low‑privileged logged-in user can view the full names of other users. Since user IDs are assigned sequentially and predictably (e.g., 1 to 1000), an attacker can extract a complete list of all users’ full names by iterating through these URLs. The same behavior can also be reproduced via the OpenProject API, allowing automated retrieval of full names through the API as well. This issue has been patched in version 16.6.2. Those who are unable to upgrade may apply the patch manually.

• CWE-200

• https://github.com/opf/openproject/commit/fb39a779f521d9b08f1e0c9e8aff2b6d4643ea37Patch
• https://github.com/opf/openproject/pull/21281Issue Tracking
• https://github.com/opf/openproject/releases/tag/v16.6.2Release Notes
• https://github.com/opf/openproject/security/advisories/GHSA-7fvx-9h6h-g82jPatch, Vendor Advisory

Published

Jan 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-22597Ghost is a Node.js content management system. In versions 5.…2.7
• CVE-2026-22598ManageIQ is an open-source management platform. A flaw was f…7.1
• CVE-2026-22599Strapi is an open source headless content management system.…7.2
• CVE-2026-2260A vulnerability was found in D-Link DCS-931L up to 1.13.0. T…7.3
• CVE-2026-22600OpenProject is an open-source, web-based project management …9.1
• CVE-2026-22601OpenProject is an open-source, web-based project management …7.2
• CVE-2026-22603OpenProject is an open-source, web-based project management …6.5
• CVE-2026-22604OpenProject is an open-source, web-based project management …5.3
• CVE-2026-22605OpenProject is an open-source, web-based project management …4.3
• CVE-2026-22606Fickling is a Python pickling decompiler and static analyzer…7.8
• CVE-2026-22607Fickling is a Python pickling decompiler and static analyzer…7.8
• CVE-2026-22608Fickling is a Python pickling decompiler and static analyzer…7.8