Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2026-24772

OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server

High8.9EPSS 0.18%
Published
Updated
Reserved
Assigned by
GitHub_M

Description

OpenProject is an open-source, web-based project management software. To enable the real time collaboration on documents, OpenProject 17.0 introduced a synchronization server. The OpenPrioject backend generates an authentication token that is currently valid for 24 hours, encrypts it with a shared secret only known to the synchronization server. The frontend hands this encrypted token and the backend URL over to the synchronization server to check user's ability to work on the document and perform intermittent saves while editing. The synchronization server does not properly validate the backend URL and sends a request with the decrypted authentication token to the endpoint that was given to the server. An attacker could use this vulnerability to decrypt a token that he intercepted by other means to gain an access token to interact with OpenProject on the victim's behalf. This vulnerability was introduced with OpenProject 17.0.0 and was fixed in 17.0.2. As a workaround, disable the collaboration feature via Settings -> Documents -> Real time collaboration -> Disable. Additionally the `hocuspocus` container should also be disabled.

Scores

CVSS scores of CVE-2026-24772, by who scored it
Scored byCVSSScoreVector
GitHub_MCNA (assigner)3.1High8.9CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
NVDNVD · Analyzed3.1Critical9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
EPSS (exploitation in 30 days)
0.18% · top 92% of all CVEs (6 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.9.

Weakness

Affected products

  • opf · openproject

    • affected OpenProject >= 17.0.0, < 17.0.2
    • affected openproject/hocuspocus < 17.0.2

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-24772 badge
[![CVE-2026-24772](https://trackcve.app/badge/CVE-2026-24772.svg)](https://trackcve.app/cve/CVE-2026-24772)

Record last updated .