VulnSocial

CVE-2026-52784Disclosure

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is a CSRF on TARGET through /users/:id via POST parameter "user[admin]". This vulnerability is fixed in 17.3.3 and 17.4.1.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-352

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 2 mentions (2026-06-26); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-06-26: 2Mentions · 2026-06-27: 1Patch / Workaround · 2026-06-26: 1Patch / Workaround · 2026-06-27: 1Technical Details · 2026-06-26: 2Technical Details · 2026-06-27: 106-2606-27
Signal classification2 categories
Disclosure
266.7%
Patch
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-06-262
Disclosure2
2026-06-271
Patch1
Full discourse3 posts
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    #CVE-2026-52784 - Critical #CSRF in @openproject . Attackers can escalate privileges via /users/:id. CVSS 8.8. Update to 17.3.3 or 17.4.1 immediately. #CVEAlert #OpenProject #infosec #cybersecurity #devsecops #devops #sysadmin More detailed info: https://www.valtersit.com/cve/CVE-2026-52784/

    Post summary

    A critical CSRF vulnerability (CVE-2026-52784) allows privilege escalation in OpenProject; administrators should immediately upgrade to versions 17.3.3 or 17.4.1.

    00010100
    966 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-52784 OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is a CSRF on TARGET through /users/:id via POST parameter "user[a… https://www.cve.org/CVERecord?id=CVE-2026-52784 ----- Traducción: CVE-2026-52784 Ope… http://infoflow.cloud`

    Post summary

    The tweet announces a CSRF vulnerability (CVE-2026-52784) in OpenProject, citing affected versions and a CVE record, but does not provide a PoC, exploit code, or patch information.

    0000037
    89 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-52784 OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is a CSRF on TARGET through /users/:id via POST parameter "user[a… https://www.cve.org/CVERecord?id=CVE-2026-52784

    Post summary

    The advisory notes a CSRF vulnerability in OpenProject prior to versions 17.3.3 and 17.4.1, with the newer releases serving as the implied patch.

    00000623
    57.7K followersView on X

Explore more

Back to dashboard