VulnSocial

CVE-2026-44733Disclosure

LOWCVSS 5.9 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass password requirements. A password validation flaw in the change password behavior allows attackers to change a user's password only with an active session takeover. This vulnerability is fixed in 17.3.2 and 17.4.0.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-620

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-06-27: 2Patch / Workaround · 2026-06-27: 2Technical Details · 2026-06-27: 206-27
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-44733 OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, Business Logic Error on OpenProject through PATCH request to /api/v3/us… https://www.cve.org/CVERecord?id=CVE-2026-44733 ----- Traducción: CVE-2026-44733 Ope… http://infoflow.cloud`

    Post summary

    This tweet announces CVE‑2026‑44733, a business‑logic error in OpenProject older than 17.3.2/17.4.0, and notes that newer releases contain a fix, without supplying PoC, exploit, or active exploitation evidence.

    0000034
    89 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-44733 OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, Business Logic Error on OpenProject through PATCH request to /api/v3/us… https://www.cve.org/CVERecord?id=CVE-2026-44733

    Post summary

    The announcement identifies a business logic vulnerability in OpenProject that is mitigated in newer releases, but no proof of concept, exploit, or active exploitation is reported.

    00000752
    57.7K followersView on X

Explore more

Back to dashboard