CVE-2026-44733

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass password requirements. A password validation flaw in the change password behavior allows attackers to change a user's password only with an active session takeover. This vulnerability is fixed in 17.3.2 and 17.4.0.

• CWE-620

• https://github.com/opf/openproject/security/advisories/GHSA-px7f-cj9f-7m4m

Published

Jun 26, 2026

Last Modified

Jun 29, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44728Babel is a compiler for writing next generation JavaScript. …7.8
• CVE-2026-44729Twenty is an open source CRM. In 1.18.0 and earlier, the fil…8.7
• CVE-2026-4473A vulnerability was detected in itsourcecode Online Doctor A…9.8
• CVE-2026-44730OpenCTI is an open source platform for managing cyber threat…7.2
• CVE-2026-44731OpenProject is open-source, web-based project management sof…4.3
• CVE-2026-44732OpenProject is open-source, web-based project management sof…4.3
• CVE-2026-44734OpenProject is open-source, web-based project management sof…6.5
• CVE-2026-44735OpenProject is open-source, web-based project management sof…6.5
• CVE-2026-44736OpenProject is open-source, web-based project management sof…6.5
• CVE-2026-44737grav-plugin-admin is the admin plugin for Grav is an HTML us…6.2
• CVE-2026-44738Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the …7.7
• CVE-2026-44739Pimcore is an Open Source Data & Experience Management Platf…8.7