OpenProject Improper Access Control Vulnerability Allows User Managers to Lock Admin Accounts

A vulnerability in OpenProject prior to version 17.0.2 allows users with the 'Manage Users' permission to lock and unlock accounts, including those of application administrators. This issue arises from a missing permission check, enabling unauthorized users to disrupt admin access. The vulnerability was concealed by a frontend flaw that only displayed lock/unlock options to full application administrators.

Impact

Exploitation of this vulnerability allows users with 'Manage Users' permission to lock application administrators out of their accounts, disrupting their access and potentially causing operational issues.

Remediation

The vulnerability has been patched in OpenProject version 17.0.2. Administrators should review and temporarily remove the 'Manage Users' permission from users until they can update to the patched version.