# CVE-2026-52783: OpenProject cleartext storage of OAuth tokens in Storages module

Source: https://junglewise.ai/threats/cve-2026-52783-openproject-cleartext-storage-of-oauth-tokens-in-storages-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-52783 · Severity: high · CVSS 8.2 · Published 2026-06-26

OpenProject, a project management platform, was found to store sensitive Microsoft OneDrive and SharePoint access tokens in an unencrypted format within its internal cache. If an attacker gains access to the system's caching service (such as Redis or Memcached), they could steal these tokens to access the organization's Azure AD and SharePoint data. This could lead to unauthorized access to sensitive corporate documents and files stored in integrated cloud storage.

## Quick answers

**Is CVE-2026-52783 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52783 being exploited in the wild.

**How severe is CVE-2026-52783?** High severity, with a CVSS score of 8.2, published 26 June 2026.

**Which products and versions are affected?** opf OpenProject < 17.3.3, >= 17.4.0 < 17.4.1.

**Is there a fix for CVE-2026-52783?** A patch was published on 2026-06-26: Fixes available in versions 17.3.3 and 17.4.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-52783 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-52783?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The OpenProject Storages module writes OneDrive/SharePoint userless OAuth access tokens in plaintext to the Rails.cache using a deterministic key (storage.<id>.httpx_access_token). Because supported cache backends like file_store, memcache, and redis do not encrypt data at rest by default, the tokens are exposed. An attacker with network access to the cache backend and low-level privileges can retrieve the Azure-AD application-tier bearer token via anonymous requests (e.g., memcached binary protocol). The vulnerability is triggered by an hourly cron job or any userless-OAuth call site that repopulates the cache. The issue is resolved in versions 17.3.3 and 17.4.1.

## Affected products

- opf OpenProject < 17.3.3, >= 17.4.0 < 17.4.1

## Timeline

- 2026-06-08: advisory: GitHub Security Advisory published by vendor
- 2026-06-26: disclosed: CVE published to NVD
- 2026-06-26: patched: Fixes available in versions 17.3.3 and 17.4.1

## References

- [https://github.com/opf/openproject/security/advisories/GHSA-h83w-5q5x-pq27](https://github.com/opf/openproject/security/advisories/GHSA-h83w-5q5x-pq27)