OpenProject EUVD-2026-39870

Exploitation requires that the attacker already hold project-admin (PR:L) on at least one project, that the OpenProject instance use the Nextcloud or OneDrive/SharePoint file-storage integration with the 'managed folder' automation enabled, and that the attacker's project and the victim's project share the same underlying storage backend so their folder IDs are addressable from the same ProjectStorage scope. The concrete trigger is a PATCH to /projects/<id>/settings/project_storages/<ps_id> with the parameter storages_project_storage[project_folder_id] set to the victim project's folder ID. Limiting factors: no anonymous/unauthenticated path (project-admin role needed), the malicious value only takes effect on the next managed-folder ACL sync rather than instantly, and instances without managed external storage or with isolated per-project backends are not exploitable.

Signals are partially aligned and partially missing. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) reflects a network-reachable, low-complexity attack that needs only project-admin privileges (PR:L) and crosses a scope boundary into another project's data and the external storage ACL - consistent with the described impact. However, exploitation is gated by real prerequisites that the raw 9.9 understates: the attacker must already be admin of some project on a shared, managed-folder-enabled storage backend, so this is a privilege-escalation/lateral-movement issue among existing tenants rather than a pre-auth internet-wide RCE. No EPSS score, no SSVC decision, no KEV listing, and no POC were provided, so probability of opportunistic mass exploitation cannot be quantified from the data. Net: a genuine high priority for multi-tenant OpenProject instances that use Nextcloud/OneDrive managed folders, but lower urgency for single-team deployments or those not using external managed storage.

An attacker who is project-admin of a low-value project on a shared Nextcloud storage learns or guesses the project_folder_id of a sensitive project, then sends a crafted PATCH request setting storages_project_storage[project_folder_id] to that value on their own project's storage settings. When the next managed-folder sync runs, OpenProject overwrites the victim folder's ACL with the attacker's project members, granting them read/write access to confidential files and locking out legitimate users. No public exploit code was identified at time of analysis, but the request is simple and low-complexity per the CVSS vector.