OpenProject Vulnerability Exposing OAuth Access Tokens in Plaintext

CVE-2026-52783

What is CVE-2026-52783?

OpenProject, an open-source project management platform, has a critical security vulnerability related to its Storages module. Before versions 17.3.3 and 17.4.1, the module stored the OneDrive/SharePoint userless OAuth access tokens in plaintext within Rails.cache. This data could be retrieved by attackers with read access to the cache backend, thus compromising the security of the Azure-AD application-tier bearer. The vulnerability arises due to the lack of encryption at rest for any of the three supported cache backends, namely file_store, memcache, and redis. As a result, users are encouraged to upgrade to the patched versions to safeguard their systems.

References