🔴 Critical Vulnerability: CVE-2026-52782 | Vulnios Threat Alert

Vulnerability Snapshot

CVE-2026-52782 is rated CRITICAL — exploitation is trivial or already observed in the wild and impact is severe. Patch immediately, not on the next maintenance window.

Executive Summary

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is an IDOR through /projects//settings/project_storages/ via PATCH parameter "storages_project_storage[project_folder_id]" leads to Access to Unauthorized Resources. A project-admin in one project can hijack the managed Nextcloud or OneDrive folder of another project on the same storage by writing the victim project's project_folder_id into the attacker's Storages::ProjectStorage row. The next managed-folder sync overwrites the ACL on the referenced folder with the attacker project's user list. This vulnerability is fixed in 17.3.3 and 17.4.1.

Why It Matters

CVE-2026-52782 is rated CRITICAL severity, requiring immediate attention from security teams.

CVSS Base Score: 9.9/10

🛡️What Defenders Should Check

Check if you are affected — Review your asset inventory for products listed in CVE-2026-52782.

Apply available patches — Visit vendor advisories for the latest security updates.

Monitor for exploitation — Check your SIEM/IDS logs for related indicators.

Use Vulnios to continuously monitor your exposure to CVE-2026-52782 and similar vulnerabilities.

References & Sources

https://github.com/opf/openproject/security/advisories/GHSA-3vpx-94qx-xpw6

How Vulnios Detects This

Vulnios scans for this vulnerability using Trivy and Grype for SBOM-based CVE matching and Vulnios CVE feed continuous monitoring against your asset inventory. Run a scan against your environment to see whether you are exposed; findings are linked back to the original CVE record so triage starts with the patch path already known.

AI Security Advisor

Get AI-powered security recommendations tailored to this specific threat — including risk assessment, detection guidance, MITRE ATT&CK mapping, and actionable remediation steps.

Sources

NVD / NIST

Related Threat Alerts

Frequently Asked Questions

What is CVE-2026-52782?

CVE-2026-52782 is a critical-severity vulnerability tracked under the Common Vulnerabilities and Exposures program. OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is an IDOR through /projects//settings/project_storages/ via PATCH parameter "storages_

Am I affected?

Affected technology is listed in the Affected Products section above. If your asset inventory contains any of them, assume in-scope until you can prove otherwise.

How urgent is the response?

Critical: do not wait for your normal patch cycle. Verify exposure today, apply the vendor patch immediately, and add detection rules for any post-exploit indicators.

How do I remediate?

Apply the vendor patch listed in the upstream advisory linked under Sources. If the patch is not yet available, follow the vendor-supplied workaround (often a config flag or feature disable) and add detections for the published exploit pattern in your SIEM. Re-scan after the patch lands to confirm the finding clears.

Where can I track exploitation activity?

Watch CISA's Known Exploited Vulnerabilities catalog for CVE-2026-52782. Cross-reference with public exploit databases and your own SIEM/IDS for indicator-of-compromise patterns. Vulnios tracks KEV status automatically and surfaces it on the asset findings view.

How does Vulnios help with this?

Vulnios continuously cross-references your asset inventory against the live CVE feed (NVD, vendor advisories, CISA KEV, and curated OSINT). When a new CVE matches your environment, you get a prioritized finding with the severity, KEV status, exploit-prediction (EPSS), and a direct path to the vendor patch. You can start a free scan from the homepage.

critical