CVE-2026-23646

OpenProject is an open-source, web-based project management software. Users of OpenProject versions prior to 16.6.5 and 17.0.1 have the ability to view and end their active sessions via Account Settings → Sessions. When deleting a session, it was not properly checked if the session belongs to the user. As the ID that is used to identify these session objects use incremental integers, users could iterate requests using `DELETE /my/sessions/:id` and thus unauthenticate other users. Users did not have access to any sensitive information (like browser identifier, IP addresses, etc) of other users that are stored in the session. The problem was patched in OpenProject versions 16.6.5 and 17.0.1. No known workarounds are available as this does not require any permissions or other that can temporarily be disabled.

• CWE-488

• https://github.com/opf/openproject/releases/tag/v16.6.5Release Notes
• https://github.com/opf/openproject/releases/tag/v17.0.1Release Notes
• https://github.com/opf/openproject/security/advisories/GHSA-w422-xf8f-v4vpVendor Advisory

Published

Jan 19, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-23636Kiteworks is a private data network (PDN). In Kiteworks Secu…7.2
• CVE-2026-23638Kiteworks is a private data network (PDN). Prior to version …6.5
• CVE-2026-2364If a legitimate user confirms a self-update prompt or initia…7.3
• CVE-2026-23643CakePHP is a rapid development framework for PHP. The Pagina…5.4
• CVE-2026-23644esm.sh is a no-build content delivery network (CDN) for web …7.5
• CVE-2026-23645SiYuan is self-hosted, open source personal knowledge manage…6.1
• CVE-2026-23647Glory RBG-100 recycler systems using the ISPK-08 software co…9.8
• CVE-2026-23648Glory RBG-100 recycler systems using the ISPK-08 software co…8.5
• CVE-2026-2365The Fluent Forms Pro plugin for WordPress is vulnerable to S…7.2
• CVE-2026-23651Permissive regular expression in Azure Compute Gallery allow…6.7
• CVE-2026-23652Improper neutralization of special elements used in a comman…9.8
• CVE-2026-23653Improper neutralization of special elements used in a comman…6.5