OpenProject’s unauthenticated password‑change endpoint (/account/change_password) lacks the brute‑force protections that guard the normal login form. An attacker who can discover or guess a valid user identifier can submit unlimited password‑reset requests without triggering lockout or rate limits. Successful guessing of a user’s password resets the account to the attacker’s chosen value, resulting in full account compromise and, depending on the user’s role, possible privilege escalation within the application. The weakness is identified as CWE‑307.

The vulnerability affects OpenProject, an open‑source, web‑based project management system, in all releases prior to version 16.6.2. Users of these older versions are at risk if the change‑password functionality is reachable without additional authentication or rate limiting.

The public CVSS score is 6.9, indicating a moderate severity, while the EPSS score is below 1 %, suggesting a low likelihood of exploitation at present. The issue is not yet listed in the CISA KEV catalog. However, the attack requires only the ability to enumerate user IDs and a low number of attempts to compromise accounts that use common passwords. Inferred from the description, the attack vector is an unauthenticated brute‑force request to the password‑change endpoint; the vulnerability can be exploited with no additional privileges and no network access beyond normal usage of the web application.