CVE-2026-52783

The record

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, OpenProject's Storages module writes the OneDrive/SharePoint userless OAuth access_token plaintext to Rails.cache under the deterministic key storage.<id>.httpx_access_token, repopulated continuously by an hourly cron and every userless-OAuth call site (see Write cadence). None of the three allowed cache backends (file_store, memcache, redis) encrypts at rest. An attacker with read access to the cache backend recovers the Azure-AD application-tier bearer with an anonymous get over the memcached binary protocol (or the equivalent against Redis). This vulnerability is fixed in 17.3.3 and 17.4.1.

Affected packages

Related vulnerabilities

• CVE-2026-14663 Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover… CWE-313
• CVE-2026-8804 Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and… CWE-313
• CVE-2026-24349 A vulnerability has been identified in SIMATIC WinCC Unified PC Runtime V16 (All… CWE-313
• CVE-2025-4397 Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a… CWE-313
• CVE-2026-6796 A vulnerability was determined in Sanluan PublicCMS up to 6.202506.d. CWE-313
• CVE-2026-6598 A security vulnerability has been detected in langflow-ai langflow up to 1.8.3. CWE-313
• CVE-2026-5531 A vulnerability has been found in SourceCodester Student Result Management System 1.0. CWE-313
• CVE-2025-64305 MicroServer copies parts of the system firmware to an unencrypted external SD card on… CWE-313