Executive brief
OpenProject, a project management platform, was found to store sensitive Microsoft OneDrive and SharePoint access tokens in an unencrypted format within its internal cache. If an attacker gains access to the system's caching service (such as Redis or Memcached), they could steal these tokens to access the organization's Azure AD and SharePoint data. This could lead to unauthorized access to sensitive corporate documents and files stored in integrated cloud storage.
Technical details
The OpenProject Storages module writes OneDrive/SharePoint userless OAuth access tokens in plaintext to the Rails.cache using a deterministic key (storage.<id>.httpx_access_token). Because supported cache backends like file_store, memcache, and redis do not encrypt data at rest by default, the tokens are exposed. An attacker with network access to the cache backend and low-level privileges can retrieve the Azure-AD application-tier bearer token via anonymous requests (e.g., memcached binary protocol). The vulnerability is triggered by an hourly cron job or any userless-OAuth call site that repopulates the cache. The issue is resolved in versions 17.3.3 and 17.4.1.
Affected products
- opf OpenProject < 17.3.3, >= 17.4.0 < 17.4.1
Timeline
- 2026-06-08: advisory: GitHub Security Advisory published by vendor
- 2026-06-26: disclosed: CVE published to NVD
- 2026-06-26: patched: Fixes available in versions 17.3.3 and 17.4.1