CVE-2026-52782: OpenProject: IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[project_folder_id]" leads to Access to Unauthorized Resources

Synopsis

This is an Insecure Direct Object Reference (IDOR) vulnerability in OpenProject, the open-source web-based project management platform. The flaw is reachable over the network by any authenticated low-privilege user (specifically a project administrator in one project) with no additional interaction required, and it carries a CVSS 9.9 Critical score because its scope extends beyond the vulnerable component. Successful exploitation lets an attacker hijack a Nextcloud or OneDrive folder belonging to a different project on the same storage, overwrite its access-control list with their own project's user list, and gain full read, write, and availability impact over that storage resource. No fix versions have been published upstream yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is served over HTTP/HTTPS, so the attacker must be able to reach the OpenProject instance across the network.

• AuthenticationRequired

  The attacker must hold a low-privilege account, specifically project-admin rights on at least one project within the target OpenProject instance.

• Victim interactionNot required

  No action by any other user or administrator is needed to carry out the IDOR write; the attacker submits the malicious PATCH request directly.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is straightforward and reliable with no race conditions or special environmental prerequisites required.

Blast Radius

• Reads all files stored in the hijacked Nextcloud or OneDrive project folder, exposing documents, attachments, and any sensitive project data belonging to the victim project.
• Modifies or deletes files in the hijacked folder after the managed-folder sync rewrites the ACL, giving the attacker full write control over the victim project's storage.
• Overwrites the folder's access-control list with the attacker's project user list, permanently locking out legitimate members of the victim project until the ACL is manually restored.
• Because the CVSS scope is Changed, impact can extend beyond the OpenProject application itself to the connected Nextcloud or OneDrive storage backend and every user or system that depends on it.