CVE.RADIO
FREN

CVE-2026-67527

opf openprojectVulnerabilityCVSS 7.6

OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/work_packages/{id} accepted _links.fileLinks and allowed authenticated users with edit_work_packages but without manage_file_links to resolve Storages::FileLink records by raw id, detach or hard-delete existing FileLinks, and re-parent FileLinks from other projects to an attacker-controlled work package, exposing origin filename, origin id, and MIME type metadata. This issue is fixed in 17.6.0.

No public exploitation has been reported so far. No distribution fix is listed yet; apply vendor mitigations and monitor.

Recommended action: Track your distribution's security tracker and apply the fix as soon as it ships.

CVE-2026-67527 opf openproject Vulnerability

Severity metrics

CVSS 3.1 : 7.6 HIGH

Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
Confidentiality impactLow
Integrity impactHigh
Availability impactLow

Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Affected & fixed versions by distribution

Versions are the native distribution strings (backport-aware): RHEL/Debian/SUSE backport fixes, so compare with the distro version comparator (dpkg / rpm / vercmp), not the upstream version.

No affected package in the tracked watchlist yet (Debian, Ubuntu, Arch, SUSE, Red Hat...). Triage may still be pending.

Sources

Advisory NVD CVE.org

Other vulnerabilities in opf openproject

Published 2026-07-30 · source: NVD