OPF OpenProject up to 17.5.x File Link /api/v3/work_packages _links.fileLinks privileges management

Summaryinfo

A vulnerability, which was classified as critical, has been found in OPF OpenProject up to 17.5.x. Impacted is an unknown function of the file /api/v3/work_packages of the component File Link. The manipulation of the argument _links.fileLinks leads to privileges management. This vulnerability is uniquely identified as CVE-2026-67527. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in OPF OpenProject up to 17.5.x and classified as critical. This issue affects an unknown functionality of the file /api/v3/work_packages of the component File Link. The manipulation of the argument _links.fileLinks with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/work_packages/{id} accepted _links.fileLinks and allowed authenticated users with edit_work_packages but without manage_file_links to resolve Storages::FileLink records by raw id, detach or hard-delete existing FileLinks, and re-parent FileLinks from other projects to an attacker-controlled work package, exposing origin filename, origin id, and MIME type metadata. This issue is fixed in 17.6.0.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-67527 since 07/29/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading to version 17.6.0 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Project Management Software

Vendor

• OPF

Name

• OpenProject

Version

• 17.0
• 17.1
• 17.2
• 17.3
• 17.4
• 17.5

Website

• Product: https://github.com/opf/openproject/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion