EUVD-2026-39870Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network PATCH with low complexity but requires project-admin (PR:L); cross-project/storage impact gives S:C with C:H and I:H (ACL overwrite), A:L since victims may lose folder access.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is an IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[project_folder_id]" leads to Access to Unauthorized Resources. A project-admin in one project can hijack the managed Nextcloud or OneDrive folder of another project on the same storage by writing the victim project's project_folder_id into the attacker's Storages::ProjectStorage row. The next managed-folder sync overwrites the ACL on the referenced folder with the attacker project's user list. This vulnerability is fixed in 17.3.3 and 17.4.1.
AnalysisAI
Cross-project folder hijacking in OpenProject before 17.3.3 and 17.4.1 lets a project-admin abuse an insecure direct object reference (CWE-639) to take over another project's managed Nextcloud or OneDrive storage folder. By PATCHing the storages_project_storage[project_folder_id] parameter on /projects/<id>/settings/project_storages/<ps_id>, an attacker writes a victim project's folder ID into their own ProjectStorage row, and the next managed-folder sync rewrites the target folder's ACL to the attacker's project member list. CVSS is 9.9 and the issue carries a scope change, but there is no public exploit identified at time of analysis and it is not on CISA KEV.
Technical ContextAI
OpenProject's file-storage integration links each project to an external storage backend (Nextcloud or OneDrive/SharePoint) through a Storages::ProjectStorage record that holds a project_folder_id and a 'managed folder' automation. A background sync job periodically reconciles the managed folder's access control list with the project's member list. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the PATCH endpoint for project_storage settings trusts the client-supplied project_folder_id without verifying that the referenced folder belongs to the same project as the ProjectStorage row being edited. Because both projects share the same underlying storage (CPE cpe:2.3:a:opf:openproject:*), an authenticated project-admin can point their own row at any folder ID on that storage, and the trusted sync process then enforces the attacker's ACL on the victim's folder.
RemediationAI
Vendor-released patch: upgrade to OpenProject 17.3.3 or 17.4.1 (whichever matches your branch), per advisory https://github.com/opf/openproject/security/advisories/GHSA-3vpx-94qx-xpw6. If immediate patching is not possible, reduce exposure by limiting who holds project-admin on projects that share a storage backend (the role required to call the vulnerable PATCH endpoint), and consider temporarily disabling the managed-folder automation / automatic ACL sync for shared Nextcloud or OneDrive storages so a tampered project_folder_id is not propagated to live folder permissions - the trade-off is that folder permissions will no longer auto-reconcile with project membership and must be managed manually. Where feasible, isolate sensitive projects onto separate storage backends so a shared-storage IDOR cannot reach them. Audit existing Storages::ProjectStorage rows for project_folder_id values that do not correspond to the owning project before and after upgrading.
More in Openproject
View allA SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbi
OpenProject is web-based project management software. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
OpenProject is open source project management software. Rated medium severity (CVSS 6.5), this vulnerability is remotely
Authenticated remote code execution affects the official openproject/openproject Docker image, which ships with a hardco
SQL injection in OpenProject's baseline-comparison (timestamps) functionality lets an authenticated, low-privileged user
OpenProject has a CVSS 9.9 command injection vulnerability allowing authenticated users to execute OS commands on the pr
Remote code execution in OpenProject before 17.3.3 and 17.4.1 arises from cache store poisoning, allowing an attacker wi
OpenProject, a web-based project management platform, contains a critical SQL injection vulnerability in versions prior
OpenProject (before 16.6.4) has a local file read vulnerability through SVG-based ImageMagick exploitation in the PDF ex
OpenProject's Repositories module contains a stored cross-site scripting (XSS) vulnerability that occurs when displaying
Token decryption in OpenProject 17.0 allows authenticated attackers to intercept and decrypt 24-hour authentication toke
Arbitrary file write in OpenProject versions before 16.6.6 and 17.0.2 allows authenticated users with repository browse
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today