OpenProject API Tokens Connect Public Enumeration to Project Authorization

OpenProject provides a project management platform and an API v3 with various authentication options including API tokens and OAuth 2.0. Through public enumeration, an attacker can discover product and deployment details from metadata endpoints, potentially exposing sensitive information before reaching project data. Using sub_type=all, page 1, and page size 1, a ZoomEye scan on November 8, 2026 identified 11,684 instances of "app=", 12,442 instances of "title=", and 45,326 instances of "http.body=".

While the "app=" and "title=" counts are consistent with the product's surface, the higher "http.body=" count may include documentation and project pages. OpenProject's API documentation states that many resources can be accessed without authentication depending on instance settings, with unauthenticated clients receiving the permissions of the anonymous user.

This highlights the importance of verifying an instance's anonymous role and project visibility before classifying API responses. OpenProject offers API tokens with bearer-token and Basic-auth forms, as well as OAuth flows. Each token is linked to a user and inherits the user's permissions within project membership and roles. Tokens for scripts can become overly broad if the user changes teams.

Regular review and rotation of tokens, as well as revoking unused ones, is recommended. The /.well-known/openproject-metadata endpoint exposes non-confidential installation metadata and can be a useful discovery aid, but should not be considered a vulnerability. Reviewing what this endpoint returns and whether disclosed installation UUID or version information aids an attacker is crucial.

Enabling OAuth and external identity adds complexity, requiring confirmation of issuer, audience, key rotation, and user mapping, as well as testing deprovisioning from the identity provider through project access. A common gap is a disabled login that leaves a personal API token active. To mitigate risks, reconcile the API token registry with the identity provider's active-user list.

The public surface review should compare the app and title candidates with DNS and internal project inventory, confirming the hostname, TLS certificate, and application owner. Disabling CORS for the API where it's not needed and reviewing the API documentation setting are also important steps. OpenProject can remain public when anonymous permissions are explicit and token lifecycles are controlled; however, it becomes risky when external discovery is the only indication that project endpoints are reachable.