OpenProject’s Storages module writes userless OAuth access tokens for OneDrive/SharePoint into Rails.cache under the deterministic key storage.<id>.httpx_access_token without encrypting data at rest. This allows an attacker with read access to the chosen cache backend to recover a bearer token that authorizes access to Azure‑AD services, effectively enabling service‑level impersonation. The flaw represents a classic cleartext storage of sensitive authentication material (CWE‑313).

Versions of OpenProject released before 17.3.3 and before 17.4.1 are impacted. All three supported Rails.cache providers—file_store, memcache, and redis—were vulnerable. The issue is resolved in releases 17.3.3 and 17.4.1 and later, so upgrading to one of those versions eliminates the flaw.

With a CVSS score of 8.2 the vulnerability is classified as high‑severity information disclosure. No EPSS score is currently available, but the absence of automatic mitigations and the sensitivity of the exposed Azure‑AD access token raise the likelihood of exploitation once discovered. The flaw is not listed in the CISA KEV catalog. Exploitation requires the attacker to read the cache backend, either by compromising an internal user or by bypassing network controls that expose the cache. Successful extraction of the token enables unauthorized access to Azure‑AD resources, which poses a significant risk to confidentiality and system integrity.