CVE-2026-52784 is a CSRF vulnerability in the open-source project management software OpenProject. It affects versions before 17.3.3 and 17.4.1. The vulnerability exists in the /users/:id endpoint where the POST parameter "user[admin]" can be exploited to perform unauthorized administrative actions. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. The vulnerability is resolved in OpenProject versions 17.3.3 and 17.4.1.

An attacker with low privileges can exploit this CSRF vulnerability to escalate privileges or perform unauthorized administrative actions on the OpenProject instance. The vulnerability impacts confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild as of the published date.

Upgrade OpenProject to version 17.3.3 or 17.4.1 or later, where this CSRF vulnerability is fixed. No other mitigation or temporary workaround is indicated in the available data.