CVE-2026-23646 is a vulnerability categorized under CWE-488 (Exposure of Data Element to Wrong Session) affecting the open-source project management software OpenProject. The flaw exists in the session management functionality where users can view and delete their active sessions via the Account Settings interface. The vulnerability arises because the DELETE endpoint for sessions (`DELETE /my/sessions/:id`) does not properly verify that the session ID being deleted belongs to the authenticated user. Since session IDs are incremental integers, an attacker can enumerate session IDs and delete sessions belonging to other users, effectively logging them out. This unauthorized session termination does not expose sensitive session data such as IP addresses or browser identifiers, but it impacts availability by disrupting user sessions. The vulnerability requires no special permissions or user interaction, making it easier to exploit remotely. The issue was patched in OpenProject versions 16.6.5 and 17.0.1. The CVSS v3.1 score is 6.5 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability. No known exploits have been reported in the wild, and no temporary mitigations are available other than upgrading to fixed versions.

For European organizations using vulnerable OpenProject versions, this vulnerability can lead to denial-of-service conditions by allowing attackers to forcibly log out legitimate users. This disruption can affect productivity, especially in environments relying heavily on OpenProject for project management and collaboration. Although no confidential information is exposed, the forced session termination could be leveraged in targeted attacks to disrupt workflows or as part of a broader attack strategy. Organizations with many users or critical projects managed via OpenProject may experience operational impacts. Additionally, repeated forced logouts could lead to user frustration and potential loss of trust in the platform's reliability. Since the vulnerability requires no authentication or user interaction, it poses a moderate risk if the OpenProject instance is exposed to untrusted networks or the internet.

The primary and only effective mitigation is to upgrade OpenProject installations to version 16.6.5 or 17.0.1 or later, where the session ownership verification flaw is fixed. Organizations should audit their OpenProject versions and prioritize patching vulnerable instances. If immediate patching is not feasible, restricting access to the OpenProject web interface via network controls such as VPNs, IP whitelisting, or web application firewalls can reduce exposure. Monitoring web server logs for unusual DELETE requests to the sessions endpoint may help detect exploitation attempts. Additionally, implementing multi-factor authentication and session timeout policies can reduce the window of opportunity for attackers. Regular backups and incident response plans should be in place to quickly recover from any disruption caused by forced logouts.