Executive brief
OpenProject is a web-based project management platform used to coordinate tasks and store project documentation. A security flaw allows a project administrator to take control of external storage folders (such as Nextcloud or OneDrive) belonging to other projects. This could lead to unauthorized access to sensitive project files and the potential for data theft or modification across the entire organization.
Technical details
An Insecure Direct Object Reference (IDOR) exists in OpenProject's project storage settings. By sending a PATCH request to the /projects/<A>/settings/project_storages/<A_ps_id> endpoint, an authenticated project administrator can modify the 'project_folder_id' parameter to point to a folder belonging to a different project. When the next managed-folder synchronization occurs, the system overwrites the Access Control List (ACL) of the victim's folder with the attacker's project user list. This allows the attacker to hijack managed Nextcloud or OneDrive folders. The vulnerability is fixed in versions 17.3.3 and 17.4.1.
Affected products
- opf OpenProject < 17.3.3, >= 17.4.0 < 17.4.1
Timeline
- 2026-06-08: advisory: GitHub Advisory GHSA-3vpx-94qx-xpw6 published
- 2026-06-26: disclosed: CVE-2026-52782 published to NVD