Vulnerability · Published Jun 26, 2026 · Assigned by GitHub_M

CVE-2026-52783OpenProject: Information Disclosure (cleartext storage of data) on localhost through memcached via Others "storage.<id>.httpx_access_token" leads to Sensitive Data Exposure

High 8.2

In plain English

A high-severity security flaw in openproject from opf. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.2%top 90.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, OpenProject's Storages module writes the OneDrive/SharePoint userless OAuth access_token plaintext to Rails.cache under the deterministic key storage.<id>.httpx_access_token, repopulated continuously by an hourly cron and every userless-OAuth call site (see Write cadence). None of the three allowed cache backends (file_store, memcache, redis) encrypts at rest. An attacker with read access to the cache backend recovers the Azure-AD application-tier bearer with an anonymous get over the memcached binary protocol (or the equivalent against Redis). This vulnerability is fixed in 17.3.3 and 17.4.1.

Affected products (as reported)

Vendor	Product	Versions
opf	openproject	< 17.3.3>= 17.4.0, < 17.4.1

Weakness: CWE-313 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

References

https://github.com/opf/openproject/security/advisories/GHSA-h83w-5q5x-pq27 x_refsource_CONFIRM