This vulnerability arises from a business logic error that allows the PATCH endpoint /api/v3/users/me to bypass password requirements. It permits an attacker who has already taken over a user session to change that user's password without providing the current password, effectively compromising the account. The weakness is classified as CWE‑620, an authentication bypass flaw, and does not provide direct code execution or denial of service.

OpenProject 17.3.x versions prior to 17.3.2 and OpenProject 17.4.x versions prior to 17.4.0 are affected. All earlier releases of the open‑source project management platform are also at risk until patched.

The CVSS score of 5.9 indicates a moderate risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to first obtain an active session on the target system; once in that session, the attacker can change the user’s password through the vulnerable API call.