An error response from the /account/change_password endpoint reveals the username of any user when an arbitrary user ID is supplied, even when the requester is not authenticated. The flaw arises because the endpoint is intended for unauthenticated use but does not sanitize or mask error information. This allows an attacker to discover all account usernames on an OpenProject instance, which can be leveraged for targeted phishing, credential stuffing, or further attacks that require knowledge of valid identities. The weakness is a classic information disclosure scenario, mapped to CWE‑200.

OpenProject versions from 11.2.1 up to (but not including) 16.6.2 are affected. The software vendor is OpenProject, and the public package is the OpenProject web application.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is less than 1%, suggesting that, at the time of this analysis, the likelihood of exploitation in the wild is low. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, and no widely publicized exploits are known. Exploitation requires only a simple HTTP POST request without authentication, making the attack vector easy to construct. An attacker with network access to the OpenProject instance can enumerate usernames by iterating through user IDs, despite there being no authenticated session required. The impact is primarily privacy and future attack facilitation rather than immediate compromise of code or data integrity.