CVE-2026-52782 is an authorization bypass vulnerability (CWE-639) in OpenProject's project storage management. Specifically, prior to versions 17.3.3 and 17.4.1, a project administrator can exploit an IDOR via the PATCH parameter "storages_project_storage[project_folder_id]" in the /projects/<A>/settings/project_storages/<A_ps_id> endpoint. By writing the victim project's project_folder_id into their own Storages::ProjectStorage record, the attacker causes the next managed-folder synchronization to overwrite the victim folder's ACL with the attacker's project user list, effectively hijacking access to that folder. This vulnerability has a CVSS 3.1 score of 9.9 (critical) and is resolved in the stated fixed versions.

Exploitation allows a project administrator in one project to gain unauthorized access and control over the managed Nextcloud or OneDrive folder of another project on the same storage. This leads to a complete compromise of confidentiality, integrity, and availability of the victim project's storage folder by overwriting its access control list with the attacker's user list. The impact is critical, as it enables unauthorized resource access and potential data manipulation or disruption.

This vulnerability is fixed in OpenProject versions 17.3.3 and 17.4.1. Users should upgrade to at least one of these versions to remediate the issue. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes. Patch status is confirmed by the version information in the description.