A low‑privileged logged‑in user can view the full names of other users. Because the system assigns user IDs sequentially, an attacker can iterate through numerical URLs or API endpoints to enumerate every user. This results in an information disclosure weakness (CWE‑200) that reveals full names to anyone with a basic account, potentially compromising personal privacy within the organization.

The flaw affects all installations of OpenProject released before version 16.6.2. Those running the open‑source web‑based project management software at any environment—on‑premises or hosted—are susceptible if they have not applied the fix. The patch is bundled in the v16.6.2 release and is also available as a manual patch for environments that cannot upgrade immediately.

The CVSS base score is 3.5, indicating low severity, and the EPSS score is less than 1 %, suggesting limited current exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog. An attacker who is authenticated as a low‑privilege user can enumerate all other users by sending repeated requests to predictable URLs or API calls, enabling automated harvesting of personal data.