CVE-2026-52783: OpenProject: Information Disclosure (cleartext storage of data) on localhost through memcached via Others "storage.<id>.httpx_access_token" leads to Sensitive Data Exposure
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, OpenProject's Storages module writes the OneDrive/SharePoint userless OAuth accesstoken plaintext to Rails.cache under the deterministic key storage.<id>.httpxaccesstoken, repopulated continuously by an hourly cron and every userless-OAuth call site (see Write cadence). None of the three allowed cache backends (filestore, memcache, redis) encrypts at rest. An attacker with read access to the cache backend recovers the Azure-AD application-tier bearer with an anonymous get over the memcached binary protocol (or the equivalent against Redis). This vulnerability is fixed in 17.3.3 and 17.4.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenProjectto a version that resolves this vulnerability.Fixed in 17.3.3 - Upgrade
Upgrade
OpenProjectto a version that resolves this vulnerability.Fixed in 17.4.1 - Operational
After upgrading to OpenProject 17.3.3 or 17.4.1, treat any OAuth access_token stored plaintext in Rails.cache under the deterministic key storage.<id>.httpx_access_token (repopulated hourly and on every userless-OAuth call site) as potentially exposed and rotate/reissue affected Azure AD (OneDrive/SharePoint) application-tier bearer tokens.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52783?
The severity of CVE-2026-52783 is high with a score of 8.2.
What does CVE-2026-52783 exploit?
CVE-2026-52783 exploits information disclosure due to cleartext storage of sensitive data through memcached.
How do I fix CVE-2026-52783?
To fix CVE-2026-52783, update OpenProject to versions 17.3.3 or 17.4.1 or later.
What sensitive data is exposed by CVE-2026-52783?
CVE-2026-52783 exposes OneDrive/SharePoint OAuth access_token in plaintext.
Is CVE-2026-52783 a local or remote vulnerability?
CVE-2026-52783 is a local vulnerability that requires access to the memcached service.