CVE-2026-52783: OpenProject Information Disclosure Flaw

CVE-2026-52783 Overview

OpenProject, an open-source web-based project management platform, stores OneDrive/SharePoint userless OAuth access_token values in plaintext within its Rails cache. The Storages module writes these Azure Active Directory application-tier bearer tokens under the deterministic key storage.<id>.httpx_access_token. None of the three supported cache backends (file_store, memcache, redis) encrypt data at rest. An attacker with read access to the cache backend can retrieve the token using an anonymous get over the memcached binary protocol or its Redis equivalent. The issue is fixed in versions 17.3.3 and 17.4.1.

Critical Impact
Attackers with cache backend access can extract Azure AD OAuth bearer tokens and impersonate the OpenProject application against Microsoft 365 tenants.

Affected Products

OpenProject versions prior to 17.3.3
OpenProject 17.4.x versions prior to 17.4.1
Deployments using file_store, memcache, or redis Rails cache backends with the Storages module enabled

Discovery Timeline

2026-06-26 - CVE-2026-52783 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-52783

Vulnerability Analysis

The vulnerability is a cleartext storage of sensitive information issue [CWE-313] affecting OpenProject's Storages integration with OneDrive and SharePoint. OpenProject caches OAuth access_token values used for userless (application-tier) authentication against Microsoft Graph. These tokens are written to Rails.cache under the predictable key storage.<id>.httpx_access_token.

An hourly cron job and every userless-OAuth call site repopulate the cache, ensuring a valid token is nearly always resident. Because Rails' supported cache backends do not provide encryption at rest, any actor with read access to the backing store retrieves the token verbatim.

The compromised token is an Azure AD application-tier bearer. It authorizes actions against the tenant's Microsoft 365 data with the scopes granted to the OpenProject app registration, bypassing user-level access controls.

Root Cause

The root cause is a design decision to persist sensitive OAuth credentials in a shared cache tier without applying application-layer encryption. The deterministic cache key removes any need for enumeration, and the token format is directly usable against Microsoft Graph without additional processing.

Attack Vector

Exploitation requires network reachability to the cache backend and read access to it. In memcache deployments, an unauthenticated get storage.<id>.httpx_access_token over the binary protocol returns the token. Equivalent commands against Redis (GET) or file inspection against file_store yield the same result. The attacker then presents the bearer token to Microsoft Graph endpoints as the OpenProject application identity.

Refer to the OpenProject GitHub Security Advisory for the vendor's technical writeup.

Detection Methods for CVE-2026-52783

Indicators of Compromise

Unexpected GET requests against Redis or memcached targeting keys matching the pattern storage.*.httpx_access_token.
Microsoft Graph API calls originating from IP addresses outside the OpenProject server's known egress range but authenticated with the OpenProject app registration.
Azure AD sign-in logs showing application-tier token usage at unusual times or from anomalous source addresses.

Detection Strategies

Enable Redis MONITOR or memcached access logging to capture reads of cache keys matching storage.*.httpx_access_token.
Audit Azure AD sign-in logs filtered on the OpenProject application ID for geographic or temporal anomalies.
Alert on any network connection to the cache port (default 6379 for Redis, 11211 for memcached) originating from outside the OpenProject application tier.

Monitoring Recommendations

Baseline expected callers of the cache backend and alert on new client IPs or user agents.
Correlate Microsoft Graph audit events with OpenProject application logs to identify Graph calls not tied to a legitimate OpenProject workflow.
Track OAuth token issuance and refresh events for the Azure AD app registration used by OpenProject.

How to Mitigate CVE-2026-52783

Immediate Actions Required

Upgrade OpenProject to version 17.3.3 or 17.4.1.
Rotate the Azure AD client secret and revoke any active OAuth tokens issued to the OpenProject app registration.
Restrict network access to Redis and memcached instances to the OpenProject application tier only, enforcing authentication where supported.

Patch Information

OpenProject addressed the issue in releases 17.3.3 and 17.4.1. Details are documented in the OpenProject GHSA-h83w-5q5x-pq27 advisory. Administrators should apply the upgrade and rotate credentials afterward, since previously cached tokens may already be exposed.

Workarounds

Bind Redis and memcached to loopback or a private subnet accessible only to the OpenProject server.
Enable Redis requirepass and TLS, and enforce SASL authentication on memcached where supported.
Set restrictive filesystem permissions on file_store cache directories to prevent read access by unprivileged users on shared hosts.

bash

# Restrict Redis to loopback and require authentication
# /etc/redis/redis.conf
bind 127.0.0.1
requirepass <strong-random-secret>
protected-mode yes