abraxas/cve-2026-52782Reproduction pack and PoC script for CVE-2026-52782, an authenticated IDOR in OpenProject project storage settings that hijacks Nextcloud/OneDrive folder ACLs.
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · CVE-2026-52782
OpenProject 17.3.2 - OpenProject GmbH
I am @abraxas_null. Loopback lab. The client is CVE-2026-52782-Abraxas-Labs.py.
IDOR on managed folders. Storages::ProjectStorages::BaseContract validates presence of project_folder_id for manual mode and never that it belongs to this project. A project-admin PATCHes another project's Nextcloud or OneDrive folder id onto their own ProjectStorage. The next managed-folder sync rewrites that folder's ACL. Fixed in 17.3.3 / 17.4.1.
| CVE | CVE-2026-52782 · CVE.org |
| CWE | CWE-639 |
| CVSS | Critical: 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| Product | OpenProject |
| Affected | all versions through 17.3.2 (inclusive) |
| Patched | 17.3.3 / 17.4.1 and later |
| Auth | authenticated |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only |
Project-admin of project A. PATCH victim project_folder_id onto A's storage. Next sync, A's members own the victim folder on Nextcloud or OneDrive. Lab oracle is the witness folder id on the attacker ProjectStorage, not a shell.
I mapped UpdateContract / UpdateService, then stood up OpenProject 17.3.2 with two projects on the same storage and ran the client.
Fail-controls already in the lab: eval/base64/system is not the witness; a reverse shell is not the witness; 17.3.3 must not accept the foreign folder id.
Port 18097. OpenProject 17.3.2. Project-admin of one project. Second project's folder id on the same storage. seed.rb plants the pair.
Target only 127.0.0.1:18097 (or the loopback you bound).
python3 CVE-2026-52782-Abraxas-Labs.py
Witness: API or edit HTML for the attacker ProjectStorage contains GHSA52782-WITNESS.
Ways to lose without learning anything:
Update OpenProject to 17.3.3 / 17.4.1 or newer. Re-run lab/poc.py against the patched build: GHSA52782-WITNESS must not appear.
github.com/opf/openproject/security/advisories/GHSA-3vpx-94qx-xpw6
Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null
GNU Affero GPL v3.0. See LICENSE.
The client talks to loopback. Using it against systems you do not own is not authorized by Abraxas Labs. No warranty.