Notice of OSF Security Incident, October 2026

We’re sharing an update about a recent security incident on OSF and our action to date. We identified an access-control issue affecting sixteen endpoints in an internal administrative application that allowed unauthorized external access to OSF users’ names and email addresses, along with three metadata fields describing public and private projects, registrations, and preprints: GUIDs, titles, and descriptions. The earliest unauthorized access recorded in system logs occurred on October 24 at 3:42 pm ET. Our team discovered the issue on October 27 at 8:15 am ET and disabled access to the application by 10:00 am that morning. The issue has been resolved.

Incident overview

On Tuesday, October 27, at approximately 8:15 am ET, our security team noticed unusual errors and began investigating. The investigation confirmed that unauthorized individuals had accessed parts of OSF’s administrative application, intended for limited internal staff to use for administrative tasks on OSF, through an access-control vulnerability introduced on October 17 to administrative tool endpoints.

By 10 am ET, access to the administrative tool had been disabled to prevent further unauthorized use while the investigation continued. Throughout the day, the team investigated related security issues and developed and tested fixes. At approximately 9 pm ET, the team released and verified the fixes, then restored access for authorized staff.

Since then, we have continued a thorough investigation of the incident, confirmed that no other issues are present, monitored the system to verify that the fix is working as expected, and analyzed what information was accessed. That work has informed the findings we are sharing today.

Information affected

The information accessed included users’ names, OSF user IDs, and email addresses, along with metadata—titles, descriptions, and globally unique identifiers (GUIDs)—for public and private projects, registrations, and preprints. User names and email addresses of OSF service moderators were also accessible through the vulnerability. The exact number of affected users is not known. We are notifying all OSF users about this incident.

Files, including those stored in private projects, were not viewed or downloaded as part of this incident. Passwords were not accessed. No user content was altered or deleted, and no data was lost.

Guidance for users

You do not need to take any action in response to this incident. If you have questions, please contact support@osf.io.

Security improvements

To eliminate the risk of a similar incident, we are re-reviewing and strengthening our access controls so that administrative pages require authorization by default. We are also adding checks for unprotected pages and automated testing to verify that access restrictions work as intended after software releases.

We know that trust depends on transparency and reliability. We apologize for the exposure of user information and the concern this incident may cause. As technology evolves, we are committed to strengthening OSF’s security through continued improvements to our tools and safeguards. We will share updates on this ongoing work.