CVE-2026-52783

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.3.3 OpenProject versions prior to 17.4.1

Description The Storages module writes the OneDrive/SharePoint userless OAuth access token in plaintext to the Rails.cache using the deterministic key storage.<id>.httpx access token. This token is repopulated by an hourly cron job and every userless-OAuth call site. Since the supported cache backends (file store, memcache, and redis) do not provide encryption at rest, an attacker with read access to the cache backend can recover the Azure-AD application-tier bearer token via an anonymous get request using the memcached binary protocol or the Redis equivalent.

Recommendations Update to version 17.3.3. Update to version 17.4.1.