CVE-2026-67527 opf CVE debrief

Who should care

Administrators and users of OpenProject versions prior to 17.6.0 should be aware of this vulnerability and take steps to mitigate it. Specifically, those with edit_work_packages but without manage_file_links permissions may be able to manipulate FileLinks, exposing metadata. Review and restrict edit_work_packages and manage_file_links permissions. Monitor for suspicious activity related to FileLinks. Upgrade to OpenProject version 17.6.0 or later. This affects OpenProject deployments where users have edit_work_packages but not manage_file_links permissions, and FileLinks are used across projects. Security teams should verify the presence of affected systems and plan for mitigation through normal change control processes. Vulnerability management teams should track exceptions and retest remediated assets to ensure the issue is fully resolved. Compensating controls, such as monitoring and detection, should be reviewed for exposed systems while remediation is scheduled and verified. Asset inventory and source tracking can help identify potentially affected systems. Rollback/change windows may be necessary for remediation. The CVE record indicates that OpenProject versions prior to 17.6.0 have a vulnerability in PATCH /api/v3/work_packages/{id} that allows authenticated users with edit_work_packages but without manage_file_links to resolve, detach, or hard-delete FileLinks and re-parent them to an attacker-controlled work package. This issue is fixed in version 17.6.0. The NVD detail and CVE record provide additional context for understanding the vulnerability and its impact. GitHub commits and pull requests also provide technical details about the fix. To confirm whether affected product deployments exist in managed environments, assign an owner for follow-up and review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Comp 0

Technical summary

The OpenProject application, prior to version 17.6.0, contains a vulnerability in the PATCH /api/v3/work_packages/{id} endpoint. This vulnerability allows authenticated users with edit_work_packages permissions but without manage_file_links permissions to manipulate FileLinks associated with work packages. Specifically, such users can resolve Storages::FileLink records by raw ID, detach or hard-delete existing FileLinks, and re-parent FileLinks from other projects to an attacker-controlled work package. This issue exposes metadata such as the origin filename, origin ID, and MIME type of the affected FileLinks.

Defensive priority

Authenticated users with edit_work_packages but without manage_file_links permissions may be able to manipulate FileLinks, exposing metadata. Review and restrict edit_work_packages and manage_file_links permissions.

Recommended defensive actions

• Review and restrict edit_work_packages and manage_file_links permissions
• Upgrade to OpenProject version 17.6.0 or later
• Monitor for suspicious activity related to FileLinks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE-2026-67527 record indicates that OpenProject versions prior to 17.6.0 have a vulnerability in PATCH /api/v3/work_packages/{id} that allows authenticated users with edit_work_packages but without manage_file_links to resolve, detach, or hard-delete FileLinks and re-parent them to an attacker-controlled work package. This issue is fixed in version 17.6.0.

Official resources