CVE-2026-24777

{"id": "CVE-2026-24777", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24777", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-09T19:14:16.807517Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 5.5, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "opf", "product": "openproject", "versions": [{"status": "affected", "version": "< 17.0.2"}]}]}], "published": "2026-02-09T19:15:50.200", "references": [{"url": "https://github.com/opf/openproject/releases/tag/v17.0.2", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/opf/openproject/security/advisories/GHSA-fq66-cwg6-qq69", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "OpenProject is an open-source, web-based project management software. Prior to 17.0.2, users with the Manage Users permission can lock and unlock users. This functionality should only be possible for users of the application, but they were not supposed to be able to lock application administrators. Due to a missing permission check this logic was not enforced. The problem was fixed in OpenProject 17.0.2The problem was fixed in OpenProject 17.0.2."}, {"lang": "es", "value": "OpenProject es un software de gesti\u00f3n de proyectos de c\u00f3digo abierto y basado en la web. Antes de la versi\u00f3n 17.0.2, los usuarios con el permiso Gestionar Usuarios pod\u00edan bloquear y desbloquear usuarios. Esta funcionalidad solo deber\u00eda ser posible para los usuarios de la aplicaci\u00f3n, pero no se supon\u00eda que pudieran bloquear a los administradores de la aplicaci\u00f3n. Debido a una comprobaci\u00f3n de permisos faltante, esta l\u00f3gica no se aplic\u00f3. El problema se solucion\u00f3 en OpenProject 17.0.2."}], "lastModified": "2026-06-17T10:23:34.603", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3FA4C106-EEE3-4582-BE10-010975AE359B", "versionEndExcluding": "17.0.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}