CVE-2026-52782: OpenProject, managed-folder IDOR

Manual project-storage mode checks that a folder id is present and never that it belongs to this project. A project admin can point their storage at another project's Nextcloud or OneDrive folder. The next sync rewrites that folder ACL.

Name: CVE-2026-52782: OpenProject, managed-folder IDOR
Type: N-day analysis
CVE: CVE-2026-52782
CVE Risk: critical
Disclosure Status: public
Vendor: OpenProject GmbH
Affected: OpenProject through 17.3.2. Patched in 17.3.3 and 17.4.1.
Published: 28 Oct 2026
Updated: 28 Oct 2026
Tags: n-day, openproject, idor, cwe-639

OpenProject, managed-folder IDOR

OpenProject 17.3.2 - OpenProject GmbH

I am @abraxas_null. Loopback lab. The client is CVE-2026-52782-Abraxas-Labs.py.

IDOR on managed folders. Storages::ProjectStorages::BaseContract validates presence of project_folder_id for manual mode and never that it belongs to this project. A project-admin PATCHes another project's Nextcloud or OneDrive folder id onto their own ProjectStorage. The next managed-folder sync rewrites that folder's ACL. Fixed in 17.3.3 / 17.4.1.

CVE-2026-52782 (NVD). CWE-639. Vendor: OpenProject GmbH. OpenProject through 17.3.2. Patched in 17.3.3 and 17.4.1.

What an attacker can do

Project-admin of project A. PATCH victim project_folder_id onto A's storage. Next sync, A's members own the victim folder on Nextcloud or OneDrive. Lab oracle is the witness folder id on the attacker ProjectStorage, not a shell.

How this showed up in the lab

I mapped UpdateContract / UpdateService, then stood up OpenProject 17.3.2 with two projects on the same storage and ran the client.

Fail-controls already in the lab: eval/base64/system is not the witness; a reverse shell is not the witness; 17.3.3 must not accept the foreign folder id.

The lab

Port 18097. OpenProject 17.3.2. Project-admin of one project. Second project's folder id on the same storage. seed.rb plants the pair.

Target only 127.0.0.1:18097 (or the loopback you bound).

Plain text

python3 CVE-2026-52782-Abraxas-Labs.py