# CVE-2026-44733: OpenProject unverified password change in users API

Source: https://junglewise.ai/threats/cve-2026-44733-openproject-unverified-password-change-in-users-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-44733 · Severity: medium · CVSS 5.9 · Published 2026-06-26

OpenProject, a web-based project management platform, contained a flaw that could allow an attacker to change a user's password without knowing the original one. This requires the attacker to have already gained access to a user's active session. If successful, the attacker could permanently take over the account, locking out the legitimate user and gaining full access to their project data and communications.

## Quick answers

**Is CVE-2026-44733 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44733 being exploited in the wild.

**How severe is CVE-2026-44733?** Medium severity, with a CVSS score of 5.9, published 26 June 2026.

**Which products and versions are affected?** opf OpenProject < 17.3.2, < 17.4.0.

**Is there a fix for CVE-2026-44733?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44733 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-44733?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A business logic error (CWE-620) exists in OpenProject's password change implementation. By sending a PATCH request to the '/api/v3/users/me' endpoint, an attacker with an active session can bypass the requirement to provide the current password when setting a new one. The attack complexity is rated as high because it requires an active session takeover (e.g., via session hijacking or physical access to a logged-in terminal) as a precondition. Successful exploitation results in account takeover. The issue is resolved in versions 17.3.2 and 17.4.0.

## Affected products

- opf OpenProject < 17.3.2, < 17.4.0

## Timeline

- 2026-05-13: advisory: GitHub advisory published by maintainers
- 2026-06-26: disclosed: NVD publication date

## References

- [https://github.com/opf/openproject/security/advisories/GHSA-px7f-cj9f-7m4m](https://github.com/opf/openproject/security/advisories/GHSA-px7f-cj9f-7m4m)