OpenProject allows authenticated users to terminate sessions of others due to a missing ownership check on the session delete endpoint. The deletion is performed by sending DELETE /my/sessions/:id requests where the :id value is a simple integer. Although no sensitive data such as IP or browser identifier is exposed, the ability to forcibly log out another user can disrupt work and impair collaborative processes. This flaw is a classic example of improper authorization leading to Denial of Service for legitimate users.

The issue affects OpenProject versions released before 16.6.5 and 17.0.1. Customers running any earlier release of OpenProject should verify that their installation does not contain the buggy delete session endpoint.

The vulnerability carries a CVSS score of 6.5 and an EPSS score of less than 1%, indicating a moderate severity but a very low probability of current exploitation. It is not listed in the CISA KEV catalog. Based on the description, the attack vector is local: an attacker must first authenticate to the web application. Once authenticated, the attacker can iterate numeric session IDs and send delete requests, force‑logging out other users regardless of permission level. The flaw requires no elevated privileges and no additional conditions beyond a valid authenticated session.