CVE-2026-52783 Details
Description
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, OpenProject's Storages module writes the OneDrive/SharePoint userless OAuth access_token plaintext to Rails.cache under the deterministic key storage.<id>.httpx_access_token, repopulated continuously by an hourly cron and every userless-OAuth call site (see Write cadence). None of the three allowed cache backends (file_store, memcache, redis) encrypts at rest. An attacker with read access to the cache backend recovers the Azure-AD application-tier bearer with an anonymous get over the memcached binary protocol (or the equivalent against Redis). This vulnerability is fixed in 17.3.3 and 17.4.1.
A vulnerability exists in OpenProject's Storages module, affecting versions prior to 17.3.3 and 17.4.1. The issue arises because userless OAuth access tokens for OneDrive and SharePoint are written in plaintext to Rails.cache, using a deterministic key that is regularly updated. This cache is not encrypted at rest, and an attacker with read access to the cache backend can retrieve the Azure-AD application-tier bearer token. The vulnerability can be exploited through an anonymous 'get' request over the memcached binary protocol or the equivalent with Redis.
Users can upgrade to OpenProject versions 17.3.3 or 17.4.1 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 26, 2026CISA-ADP
Assessed Jun 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/opf/openproject/security/advisories/GHSA-h83w-5q5x-pq27 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-313 | Cleartext Storage in a File or on Disk | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenProject | < 17.3.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | New CVE Received | [email protected] |