CVE-2026-67527 is a missing authorization vulnerability (CWE-862) in OpenProject before version 17.6.0. The PATCH /api/v3/work_packages/{id} endpoint improperly allowed users with edit_work_packages privileges but lacking manage_file_links rights to resolve and manipulate Storages::FileLink records by raw ID. This enabled unauthorized detachment, hard deletion, and re-parenting of FileLinks across projects, exposing sensitive metadata including origin filename, origin ID, and MIME type. The vulnerability is addressed in OpenProject 17.6.0.

An attacker with authenticated access and edit_work_packages permission could perform unauthorized operations on file link records, including detaching, deleting, or re-parenting them, potentially leading to unauthorized data exposure and integrity issues. Confidential metadata such as original filenames and MIME types could be disclosed. The vulnerability has a CVSS 3.1 score of 7.6 (high severity), indicating significant impact on confidentiality, integrity, and availability.

This vulnerability is fixed in OpenProject version 17.6.0. Users should upgrade to version 17.6.0 or later to remediate this issue. No official patch or temporary fix is indicated beyond upgrading. Since this is not a cloud service, remediation depends on user action.