PT-2026-52914 · Undefined · Undefined

Published 2026-06-26 · Updated 2026-06-26 · CVE-2026-52783

NVD

CVSS v3.1

8.2

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, OpenProject's Storages module writes the OneDrive/SharePoint userless OAuth access token plaintext to Rails.cache under the deterministic key storage..httpx access token, repopulated continuously by an hourly cron and every userless-OAuth call site (see Write cadence). None of the three allowed cache backends (file store, memcache, redis) encrypts at rest. An attacker with read access to the cache backend recovers the Azure-AD application-tier bearer with an anonymous get over the memcached binary protocol (or the equivalent against Redis). This vulnerability is fixed in 17.3.3 and 17.4.1.

Fix

Weakness Enumeration

CWE-313

Related Identifiers

CVE-2026-52783

Affected Products

Undefined

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-52783 · Security Note
• https://github.com/opf/openproject/security/advisories/GHSA-h83w-5q5x-pq27 · Note