CVE-2026-24772 is a high severity (CVSS 8.9) flaw in the real-time collaboration server added in OpenProject 17.0. The server does not validate the backend URL it is given, and sends a decrypted access token there. OpenProject 17.0.0 and 17.0.1 are affected. Upgrade to 17.0.2.
What's affected
The GitHub advisory lists OpenProject 17.0.0 and 17.0.1 as affected, with 17.0.2 patched. The openproject/hocuspocus container, which is the synchronization server, is affected in all versions before 17.0.2.
Here is how it works. The backend creates an authentication token valid for 24 hours and encrypts it with a secret known only to the synchronization server. The frontend passes the encrypted token and the backend URL to that server. The server does not properly validate the URL, and sends the decrypted token to whatever endpoint it was given. An attacker who has intercepted an encrypted token could use that to obtain an access token and act on the victim's behalf.
How to check if you're exposed
Check your OpenProject version in the administration area, or the image tag:
docker ps --format '{{.Image}}' | grep -i -E 'openproject|hocuspocus'
If you run 17.0.0 or 17.0.1, or a hocuspocus image older than 17.0.2, you are in range. If real-time collaboration is not enabled, the synchronization server is not in use.
For a quick look at your own dependencies, Safeguard's free in-browser dependency scan at https://gold.safeguard.sh/scan checks them against known CVEs in your browser.
What to do now
- Upgrade OpenProject and the hocuspocus container to 17.0.2 or later.
- If you cannot upgrade yet, disable real-time collaboration in Settings, then Documents, then Real time collaboration.
- Also stop the hocuspocus container, as the advisory says.
- Review which users can create documents and share links.
- Re-run your upgrade checks on every environment.
Why it matters
The weakness is CWE-345, insufficient verification of data authenticity. The synchronization server accepted a URL from the client and trusted it, so it sent a secret to a destination it should have checked. Servers that forward credentials need an allow list of where they may send them.
The attack needs the attacker to have intercepted an encrypted token by other means, and user interaction, which lowers the odds, but a token that lasts 24 hours gives a long window. The CVE is not in CISA's Known Exploited Vulnerabilities catalog.
A server that forwards secrets
The OpenProject flaw is a good case study in a pattern that appears in many systems: a component receives a destination from a client and then sends something sensitive there. The synchronization server decrypts a token and then forwards it to the backend URL it was handed, without checking that the URL is the real backend.
The attack described in the advisory needs a precondition. The attacker must have intercepted an encrypted token by some other means. That reduces the likelihood, but it shows why defense in depth matters, since intercepted data should not be useful to anyone who is not the intended recipient.
How to reduce exposure beyond the upgrade
Configure the synchronization server with the backend address it is allowed to talk to, rather than accepting one per request, wherever the product allows. Keep traffic between the browser, the application and the synchronization server on HTTPS only, so that interception is harder. Limit the lifetime of tokens where you can; here it is 24 hours, which is a long time for a collaboration session.
If you cannot upgrade today
The advisory offers a clear workaround: turn off real-time collaboration in the document settings and stop the hocuspocus container. Do both, since stopping only the setting leaves the container running. Tell your users that collaborative editing will not work until you upgrade.
Check your footprint
Self-hosted project tools often run in several places, such as production, staging and a demo instance. Check each one. The versions at risk are 17.0.0 and 17.0.1, so an instance that is still on the 16.x line is not in the affected range, although it has its own upgrade path to plan.
After you upgrade, confirm the container image version as well as the application version, because the synchronization server ships separately.
Quick check
Is there a workaround?
Yes. Disable real-time collaboration in the settings and stop the hocuspocus container, per the advisory.
Which version fixes it?
OpenProject 17.0.2.
Sources
Last reviewed: 19 October 2026.
