CVE-2026-52783
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
OpenProject versions prior to 17.3.3 and 17.4.1 store the OneDrive/SharePoint userless OAuth access token in plaintext in Rails.cache under a deterministic key. The token is continuously refreshed by an hourly cron and OAuth call sites, and none of the allowed cache backends (file_store, memcache, redis) encrypt data at rest.
Risk Assessment
An attacker with read access to the cache backend (e.g., memcached or Redis) can recover the Azure-AD application-tier bearer token, enabling unauthorized access to OneDrive/SharePoint without user authentication.
Recommendation
Immediately upgrade OpenProject to version 17.3.3 or 17.4.1, which fix this vulnerability. Additionally, enable encryption at rest for the cache backend if possible.
Other vulnerabilities in OpenProject
See all- CVE-2026-22601High
OpenProject is an open-source, web-based project management software. In version 16.6.1 and below, a registered administrator can execute arbitrary commands by configuring the sendmail binary path and sending a test email. This issue has been patched in version 16.6.2.
- CVE-2017-11667High
OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, allowing remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session.
- CVE-2026-52785Critical
OpenProject before versions 17.3.3 and 17.4.1 contains a SQL injection vulnerability in the timestamps functionality. Attackers can exploit the timestamps parameter to execute unauthorized database queries.
- CVE-2026-52782Critical
In OpenProject prior to versions 17.3.3 and 17.4.1, an IDOR vulnerability exists in the endpoint /projects/<A>/settings/project_storages/<A_ps_id> via the PATCH parameter "storages_project_storage[project_folder_id]". A project administrator can hijack the managed Nextcloud or OneDrive folder of another project on the same storage, leading to unauthorized resource access.
- CVE-2026-46386Critical
The official openproject/openproject Docker image ships with a default SECRET_KEY_BASE=OVERWRITE_ME, which combined with cookies_serializer = :marshal allows any logged-in user a deterministic Marshal-deserialization path via the /my/two_factor_devices cookie reader. This vulnerability is fixed in a later version.
- CVE-2026-34717Critical
OpenProject prior to version 17.2.3 has an SQL injection vulnerability in the =n operator in modules/reporting/lib/report/operator.rb:177. This operator embeds user input directly into SQL WHERE clauses without parameterization.
- CVE-2026-22600Critical
OpenProject before version 16.6.4 contains a Local File Read vulnerability in the work package PDF export. By uploading a specially crafted SVG file (disguised as PNG) as an attachment, an attacker can exploit the ImageMagick engine to read arbitrary local files accessible to the application user.
- CVE-2026-55095Medium
OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw custom_field_ project attribute. The dialog path resolves the project custom field by its raw identifier without enforcing the normal admin_only visibility scope and renders the stored custom-field comment in read-only mode. This discloses hidden comment text but does not disclose the custom-field value or permit writes or mutation. This issue is reported as fixed in version 17.6.0.
- CVE-2026-67529Medium
OpenProject before 17.6.0 in GET /api/v3/time_entries and GET /api/v3/cost_entries exposed private work package titles and IDs without visibility checks. Users with view_time_entries or view_cost_entries could read this data.
- CVE-2026-67528Medium
OpenProject before 17.6.0 in GET /api/v3/custom_options/:id resolved custom options by global numeric ID without visibility checks. Authenticated non-admin users could enumerate IDs and read labels of admin-only options.
Original NVD description (English source)
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, OpenProject's Storages module writes the OneDrive/SharePoint userless OAuth access_token plaintext to Rails.cache under the deterministic key storage.<id>.httpx_access_token, repopulated continuously by an hourly cron and every userless-OAuth call site (see Write cadence). None of the three allowed cache backends (file_store, memcache, redis) encrypts at rest. An attacker with read access to the cache backend recovers the Azure-AD application-tier bearer with an anonymous get over the memcached binary protocol (or the equivalent against Redis). This vulnerability is fixed in 17.3.3 and 17.4.1.