CVE-2026-24772: OpenProject Real-Time Collaboration Token Verification Flaw

Overview

OpenProject added a synchronization server in the 17.0.0 line to support real-time collaborative editing of documents. According to the record, the backend creates an authentication token valid for 24 hours, encrypts it with a secret shared only with the synchronization server, and the frontend passes that encrypted token and the backend URL to the synchronization server. The record states that the synchronization server does not properly validate the backend URL, which is classified as CWE-345 (Insufficient Verification of Data Authenticity).

Impact

• According to the record, a party who already holds a valid token obtained by other means could use this flaw to recover the token in usable form and act on the victim's behalf inside OpenProject.
• NVD assigns a score of 9.0 with CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. The GitHub CNA lists 8.9 for the same CVSS 3.1 framework.
• The record indicates high impact on confidentiality, integrity and availability, with a changed scope.

Affected products and versions

• The record lists OpenProject (product name Openproject Openproject) in the range 17.0.0 up to but not including 17.0.2.
• The description states the flaw was introduced in 17.0.0 and fixed in 17.0.2. The structured fixes list in the record is empty, so the fixed version is taken from the description and the GitHub advisory.
• Installations outside this range are not described as affected in the sources consulted.

Exploitation status

The CISA Known Exploited Vulnerabilities catalog does not list this CVE in the record, and no EPSS score is available. No confirmed exploitation appears in the sources consulted. The record does not describe any observed attacks.

Remediation and mitigation

• Upgrade OpenProject to 17.0.2 or a later release, as described in the GitHub security advisory.
• If upgrading cannot be done immediately, follow the documented workaround: disable real-time collaboration under Settings, Documents, Real time collaboration, and select Disable. The record also says the hocuspocus container should be disabled.
• After patching, reviewing whether the shared secret between the backend and the synchronization server should be rotated is a reasonable precaution. This is an inference; the sources do not state it.

Detection guidance

• Review whether the collaboration feature and the hocuspocus container are deployed in your environment, since the workaround depends on them.
• Monitor outbound requests from the synchronization server to hosts other than the expected OpenProject backend.
• Review authentication and session logs for OpenProject for unusual activity that does not match legitimate users.

Limitations of the available information

• The record does not list fixed versions beyond 17.0.2, commit details, or additional advisories beyond the GitHub advisory.
• The NVD and GitHub scores differ slightly (9.0 and 8.9).
• No KEV entry, EPSS score or SSVC data is present in the record.
• The record description contains the spelling OpenPrioject, which is kept here as it appears in the source.

Frequently asked questions

Which OpenProject versions are affected by CVE-2026-24772?

The record lists versions from 17.0.0 up to but not including 17.0.2. Installations in that range should be upgraded to 17.0.2 or later.

Is this vulnerability being actively exploited?

The CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted.

What is the workaround if I cannot upgrade right away?

The record recommends disabling real-time collaboration under Settings, Documents, Real time collaboration, and also disabling the hocuspocus container.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.