The vulnerability allows an attacker to alter the "user[admin]" field via a POST request to /users/:id. This CSRF flaw can elevate a non‑admin user’s permissions by granting them administrative authority, potentially compromising the entire application. The weakness is classified as CWE‑352, highlighting the risk of unauthorized state change without proper verification.

Affected are installations of OpenProject prior to version 17.3.3 and prior to version 17.4.1, regardless of deployment environment. Any version of OpenProject lacking the patch is susceptible.

The CVSS score of 8.8 indicates high severity, but the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Exploitation likely requires the victim to be logged into a target OpenProject instance and to visit a malicious site that posts to the vulnerable endpoint. The attacker can then set the admin flag for the victim’s account or another user, enabling full control over project data. The high score combined with the common CSRF attack vector makes this a significant risk for organizations whose users have administrative editing privileges.