OpenProject Session Management Vulnerability Allowing Unauthorized Session Termination

A vulnerability exists in OpenProject versions prior to 16.6.5 and 17.0.1, allowing users to terminate other users' active sessions. This issue arises because the application does not properly verify session ownership when a session is deleted. Users can exploit this by sending requests to delete sessions using the session ID, which is an incremental integer. Although this vulnerability does not expose any sensitive information from the session, it improperly disrupts other users' sessions.

Impact

Exploitation of this vulnerability allows users to log out other users by terminating their active sessions.

Remediation

Users are advised to update OpenProject to version 16.6.5 or 17.0.1.