OpenProject, an open‑source project‑management platform, contains a flaw that permits any user granted the Manage Users permission to lock or unlock any account, including those belonging to application administrators. The missing permission check allows a legitimate user to disable administrative access, resulting in a denial of service for critical management functions. The weakness is a missing authorization check, identified as CWE‑862.

The vulnerability affects OpenProject installations prior to version 17.0.2. Any role with Manage Users rights, regardless of other privileges, can target administrator accounts. Versions 17.0.2 and later have the fix in place.

The CVSS score of 6.7 indicates moderate severity, while the EPSS score of less than 1 % reflects a very low probability of exploitation in the wild. The issue is not listed in the CISA KEV catalog. Exploitation requires a legitimate user with Manage Users rights, so an attacker would typically be an insider or one who has gained such permissions. Although it does not enable remote code execution, it permits administrative lock‑out, which can disrupt project‑management operations.