CVE-2026-52783
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk3th percentile — higher than 3% of all known CVEs
Summary
OpenProject versions prior to 17.3.3 and 17.4.1 store the OneDrive/SharePoint userless OAuth access token in plaintext in Rails.cache under a deterministic key. The token is continuously refreshed by an hourly cron and OAuth call sites, and none of the allowed cache backends (file_store, memcache, redis) encrypt data at rest.
Risk Assessment
An attacker with read access to the cache backend (e.g., memcached or Redis) can recover the Azure-AD application-tier bearer token, enabling unauthorized access to OneDrive/SharePoint without user authentication.
Recommendation
Immediately upgrade OpenProject to version 17.3.3 or 17.4.1, which fix this vulnerability. Additionally, enable encryption at rest for the cache backend if possible.
Original NVD description (English source)
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, OpenProject's Storages module writes the OneDrive/SharePoint userless OAuth access_token plaintext to Rails.cache under the deterministic key storage.<id>.httpx_access_token, repopulated continuously by an hourly cron and every userless-OAuth call site (see Write cadence). None of the three allowed cache backends (file_store, memcache, redis) encrypts at rest. An attacker with read access to the cache backend recovers the Azure-AD application-tier bearer with an anonymous get over the memcached binary protocol (or the equivalent against Redis). This vulnerability is fixed in 17.3.3 and 17.4.1.