CVE-2026-67527: CWE-862: Missing Authorization in opf openproject
OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/work_packages/{id} accepted _links.fileLinks and allowed authenticated users with edit_work_packages but without manage_file_links to resolve Storages::FileLink records by raw id, detach or hard-delete existing FileLinks, and re-parent FileLinks from other projects to an attacker-controlled work package, exposing origin filename, origin id, and MIME type metadata. This issue is fixed in 17.6.0.
AI Analysis
Technical Summary
CVE-2026-67527 is a missing authorization vulnerability (CWE-862) in OpenProject before version 17.6.0. The PATCH /api/v3/work_packages/{id} endpoint improperly allows authenticated users who have edit_work_packages permission but lack manage_file_links permission to resolve Storages::FileLink records by raw id. This enables them to detach or hard-delete existing FileLinks and re-parent FileLinks from other projects to work packages they control. Metadata such as origin filename, origin id, and MIME type can be exposed through this flaw. The vulnerability is addressed in OpenProject 17.6.0.
Potential Impact
An attacker with authenticated access and edit_work_packages permission can manipulate file link records beyond their intended privileges, potentially deleting or reassigning file links across projects and accessing sensitive file metadata. This could lead to unauthorized data exposure and integrity issues within project files. The CVSS score of 7.6 (high) reflects the significant impact on confidentiality and integrity, with low attack complexity and no user interaction required.
Mitigation Recommendations
This vulnerability is fixed in OpenProject version 17.6.0. Users should upgrade to version 17.6.0 or later to remediate this issue. Patch status is not explicitly confirmed in the vendor advisory, but the fix is stated to be included in 17.6.0. No alternative mitigations are indicated.
CVE-2026-67527: CWE-862: Missing Authorization in opf openproject
Description
OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/work_packages/{id} accepted _links.fileLinks and allowed authenticated users with edit_work_packages but without manage_file_links to resolve Storages::FileLink records by raw id, detach or hard-delete existing FileLinks, and re-parent FileLinks from other projects to an attacker-controlled work package, exposing origin filename, origin id, and MIME type metadata. This issue is fixed in 17.6.0.
CVSS v3.1
Score 7.6high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-67527 is a missing authorization vulnerability (CWE-862) in OpenProject before version 17.6.0. The PATCH /api/v3/work_packages/{id} endpoint improperly allows authenticated users who have edit_work_packages permission but lack manage_file_links permission to resolve Storages::FileLink records by raw id. This enables them to detach or hard-delete existing FileLinks and re-parent FileLinks from other projects to work packages they control. Metadata such as origin filename, origin id, and MIME type can be exposed through this flaw. The vulnerability is addressed in OpenProject 17.6.0.
Potential Impact
An attacker with authenticated access and edit_work_packages permission can manipulate file link records beyond their intended privileges, potentially deleting or reassigning file links across projects and accessing sensitive file metadata. This could lead to unauthorized data exposure and integrity issues within project files. The CVSS score of 7.6 (high) reflects the significant impact on confidentiality and integrity, with low attack complexity and no user interaction required.
Mitigation Recommendations
This vulnerability is fixed in OpenProject version 17.6.0. Users should upgrade to version 17.6.0 or later to remediate this issue. Patch status is not explicitly confirmed in the vendor advisory, but the fix is stated to be included in 17.6.0. No alternative mitigations are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-29T18:47:17.073Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a6ba8439c2644c7f892a6db
Added to database: 07/30/2026, 19:38:43 UTC
Last enriched: 07/30/2026, 19:52:21 UTC
Last updated: 07/30/2026, 21:22:02 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.