CVE-2026-44733

The record

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass password requirements. A password validation flaw in the change password behavior allows attackers to change a user's password only with an active session takeover. This vulnerability is fixed in 17.3.2 and 17.4.0.

Affected packages

Related vulnerabilities

• CVE-2026-97380 MariaDB server is a community developed fork of MySQL server. CWE-620
• CVE-2026-85591 phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user… CWE-620
• CVE-2026-73292 Semaphore UI is a web interface for managing DevOps tools. CWE-620
• CVE-2026-54801 A vulnerability has been identified in CPCI85 Central Processing/Communication (All… CWE-620
• CVE-2025-71328 Flowise before 3.0.10 contains an unverified password change vulnerability. CWE-620
• CVE-2025-71337 Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email… CWE-620
• CVE-2026-5386 The affected KMW CCTV Security Cameras are vulnerable to a critical unauthenticated… CWE-620
• CVE-2026-8327 Concrete CMS below 9.5.0 and below is vulnerable to password change without… CWE-620