CVE-2026-67527

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.6.0

Description Authenticated users with edit work packages permissions, but lacking manage file links permissions, can manipulate file links via the 'PATCH /api/v3/work packages/{id}' endpoint. By using the links.fileLinks parameter, an attacker can resolve Storages::FileLink records by raw ID, detach or permanently delete existing file links, or re-parent file links from other projects to a work package under their control. This action exposes metadata including the origin filename, origin ID, and MIME type.

Recommendations Update to version 17.6.0.