CVE-2026-52782: CWE-639: Authorization Bypass Through User-Controlled Key in opf openproject
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is an IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[project_folder_id]" leads to Access to Unauthorized Resources. A project-admin in one project can hijack the managed Nextcloud or OneDrive folder of another project on the same storage by writing the victim project's project_folder_id into the attacker's Storages::ProjectStorage row. The next managed-folder sync overwrites the ACL on the referenced folder with the attacker project's user list. This vulnerability is fixed in 17.3.3 and 17.4.1.
AI Analysis
Technical Summary
OpenProject versions prior to 17.3.3 and 17.4.1 have an authorization bypass vulnerability (CWE-639) via an IDOR in the PATCH parameter "storages_project_storage[project_folder_id]" at the /projects/<A>/settings/project_storages/<A_ps_id> endpoint. This flaw allows a project-admin of one project to write the project_folder_id of a victim project into their own Storages::ProjectStorage record. Consequently, during the next managed-folder synchronization, the ACL on the victim's folder is overwritten with the attacker project's user list, effectively hijacking access to the victim's Nextcloud or OneDrive folder. This vulnerability is rated critical with a CVSS 3.1 score of 9.9 and is fixed in OpenProject versions 17.3.3 and 17.4.1.
Potential Impact
An attacker with project-admin privileges on one project can gain unauthorized access and control over the storage folder of another project on the same storage system. This can lead to complete compromise of confidentiality, integrity, and availability of the victim project's managed Nextcloud or OneDrive folder by overwriting its ACLs with the attacker's user list.
Mitigation Recommendations
Upgrade OpenProject to version 17.3.3 or 17.4.1 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated. Patch status is confirmed fixed in these versions.
CVE-2026-52782: CWE-639: Authorization Bypass Through User-Controlled Key in opf openproject
Description
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is an IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[project_folder_id]" leads to Access to Unauthorized Resources. A project-admin in one project can hijack the managed Nextcloud or OneDrive folder of another project on the same storage by writing the victim project's project_folder_id into the attacker's Storages::ProjectStorage row. The next managed-folder sync overwrites the ACL on the referenced folder with the attacker project's user list. This vulnerability is fixed in 17.3.3 and 17.4.1.
CVSS v3.1
Score 9.9critical
Affected software
pkg:github/opf/openprojectRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenProject versions prior to 17.3.3 and 17.4.1 have an authorization bypass vulnerability (CWE-639) via an IDOR in the PATCH parameter "storages_project_storage[project_folder_id]" at the /projects/<A>/settings/project_storages/<A_ps_id> endpoint. This flaw allows a project-admin of one project to write the project_folder_id of a victim project into their own Storages::ProjectStorage record. Consequently, during the next managed-folder synchronization, the ACL on the victim's folder is overwritten with the attacker project's user list, effectively hijacking access to the victim's Nextcloud or OneDrive folder. This vulnerability is rated critical with a CVSS 3.1 score of 9.9 and is fixed in OpenProject versions 17.3.3 and 17.4.1.
Potential Impact
An attacker with project-admin privileges on one project can gain unauthorized access and control over the storage folder of another project on the same storage system. This can lead to complete compromise of confidentiality, integrity, and availability of the victim project's managed Nextcloud or OneDrive folder by overwriting its ACLs with the attacker's user list.
Mitigation Recommendations
Upgrade OpenProject to version 17.3.3 or 17.4.1 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated. Patch status is confirmed fixed in these versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-08T17:13:43.065Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3ed4eb72d29f1837ec3429
Added to database: 06/26/2026, 19:37:15 UTC
Last enriched: 07/03/2026, 22:31:39 UTC
Last updated: 08/10/2026, 12:41:11 UTC
Views: 85
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.