OSF administrative access flaw exposes user contacts and private project metadata
OSF confirms unauthorized access through sixteen internal administrative endpoints. Names, emails, user IDs and project metadata were exposed, including private project titles and descriptions. The operator says files and passwords were not accessed; the affected-user count is unknown.
- Disclosed
- Oct 29, 2026
- Public disclosure date
- Severity
- Sharted
- No CVE: a breach, not a bug
- Splash zone
- OSF users, moderators and owners of public or private projects, registrations and preprints
- OSF · SaaS · access control
- In the wild
- Yes
- OSF confirms unauthorized external access and says the issue is resolved.
What happened
Exposed metadata includes GUIDs, titles and descriptions. OSF reports no content changes, deletions or data loss. L3 reflects a research platform’s confirmed intrusion; it does not imply that private research files were downloaded.
Crime-scene timeline
Oct 17, 2026
Administrative access-control vulnerability introduced
Oct 24, 2026
Earliest unauthorized access in logs
Oct 27, 2026
Application disabled, then fixes verified and staff access restored
Oct 29, 2026
Public incident notice
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- OSF incident noticePrimaryConfirms accessed metadata, containment and exclusions; all users are being notified.