CVE Intelligence
Analysis AI-assisted

CVE-2026-52782: OpenProject Broken Access Control (IDOR) in Project Storage Folder Assignment

CVE-2026-52782 affects OpenProject versions prior to 17.3.3 and 17.4.1. According to the record, a project administrator can reassign the managed folder of another project on the same Nextcloud or OneDrive storage, so the next sync applies the attacker project's user list to that folder. The CNA rated it critical with CVSS 3.1 score 9.9, and it is not listed in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

OpenProject is open-source, web-based project management software. According to the record, versions before 17.3.3 and 17.4.1 contain an insecure direct object reference in project storage settings that can let a project administrator affect a folder belonging to another project on the same storage.

Impact

  • A project administrator may gain access to resources outside their own project scope.
  • The record states that a managed Nextcloud or OneDrive folder of another project can be reassigned, and that the next sync overwrites that folder's access control list with the attacker project's user list.
  • The CVSS 3.1 score of 9.9 reflects high confidentiality, integrity and availability impact with scope change, as scored by the CNA.

Affected products and versions

  • Product: OpenProject. The description indicates that versions prior to 17.3.3 and 17.4.1 are affected.
  • The structured affected list in the record is empty, so the exact affected version set should be confirmed in the GitHub advisory.
  • Fixed versions named in the description: 17.3.3 and 17.4.1.

Exploitation status

This CVE is not listed in the CISA KEV catalog according to the record. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00454 with percentile 0.37652, as recorded.

Remediation and mitigation

  • Upgrade OpenProject to 17.3.3 or 17.4.1, depending on the release line in use.
  • Review which users hold project administrator rights and limit them to trusted personnel until the upgrade is complete.
  • Audit permissions on folders in connected Nextcloud or OneDrive storage for user lists that do not match project membership.

Detection guidance

  • Review audit logs for changes to project storage configurations, especially folder reassignments between projects.
  • Compare managed folder permissions on external storage with the expected membership of each project.
  • Watch for unexpected access control changes on storage folders after scheduled synchronization runs.

Limitations of the available information

  • The record has no structured affected version list, so the exact range and any other affected release lines are not confirmed here.
  • The record shows a source status of Deferred and gives no vendor-independent testing details.
  • Whether any workaround exists besides upgrading is not stated in the record.

Frequently asked questions

What is CVE-2026-52782?

It is an insecure direct object reference in OpenProject project storage settings that affects versions before 17.3.3 and 17.4.1, as described in the record.

Which versions are fixed?

The description states that the issue is fixed in OpenProject 17.3.3 and 17.4.1. The structured affected list in the record is empty, so confirm the full affected range in the GitHub advisory.

Is this vulnerability being actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.