What is the CVSS score of CVE-2026-67527?

CVE-2026-67527 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L. EPSS exploitation probability: 0.2%.

Which versions of OpenProject are affected by CVE-2026-67527?

OpenProject versions before 17.6.0 contain a broken authorization flaw that allows any authenticated project editor to view, delete, and manipulate file links across project boundaries without proper…. A patch is available.

How to fix or mitigate CVE-2026-67527?

Within 24 hours, audit all users with edit_work_packages permission and restrict this role to administrators and trusted staff only; enable comprehensive logging for all file-storage API modifications. Within 7 days, review access logs for the /api/v3/work_packages endpoint to identify any suspicious PATCH requests and unauthorized file-link modifications. Within 30 days, upgrade OpenProject to version 17.6.0 or later; validate file authorization controls by confirming low-privilege accounts can no longer manipulate file links outside their intended scope.

OpenProject CVE-2026-67527

EUVD-2026-51280 HIGH

Missing Authorization (CWE-862)

2026-07-30 GitHub_M

Authentication Bypass Openproject

7.6

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

vuln.today AI

7.6 HIGH

Network API reachable by an authenticated editor (PR:L, AC:L); high integrity from unauthorized delete/re-parent, low confidentiality from metadata leak, low availability from data destruction.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Jul 30, 2026 - 20:03 EUVD

Source Code Evidence Fetched

Jul 30, 2026 - 19:51 vuln.today

Analysis Generated

Jul 30, 2026 - 19:51 vuln.today

CVE Published

Jul 30, 2026 - 19:19 cve.org

HIGH 7.6

DescriptionCVE.org

OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/work_packages/{id} accepted _links.fileLinks and allowed authenticated users with edit_work_packages but without manage_file_links to resolve Storages::FileLink records by raw id, detach or hard-delete existing FileLinks, and re-parent FileLinks from other projects to an attacker-controlled work package, exposing origin filename, origin id, and MIME type metadata. This issue is fixed in 17.6.0.

AnalysisAI

Broken authorization in OpenProject before 17.6.0 lets authenticated users holding only the edit_work_packages permission manipulate file-storage links they should not control. By submitting _links.fileLinks to PATCH /api/v3/work_packages/{id}, an attacker lacking manage_file_links can resolve Storages::FileLink records by raw id to detach or hard-delete them, re-parent FileLinks from other projects onto their own work package, and read origin filename, origin id, and MIME-type metadata. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is remotely reachable by any low-privileged project editor.

Technical ContextAI

OpenProject is a Ruby on Rails web-based project management platform that integrates external file storages (e.g. Nextcloud, OneDrive/SharePoint) by attaching Storages::FileLink records to work packages. The root cause is CWE-862 (Missing Authorization): the work package update path accepted a file_links_ids array parsed from _links.fileLinks hrefs and directly assigned model.file_links = Storages::FileLink.where(id: file_links_ids) in SetAttributesService without checking the manage_file_links permission. Because the has_many :file_links association used dependent: :delete_all, replacing the collection silently hard-deleted the previously associated links, and resolving links by raw database id let records from unrelated projects be re-parented. The fix (PR #23815, commit db480bd) removes the unguarded write path and introduces a ValidateReplacements contract that enforces both manage_file_links authorization and same-storage/ownership checks before any replacement is applied.

RemediationAI

Vendor-released patch: upgrade to OpenProject 17.6.0 or later, which removes the unauthorized file_links_ids write path and adds the ValidateReplacements contract enforcing manage_file_links plus same-storage and ownership checks (see PR https://github.com/opf/openproject/pull/23815 and commit db480bdeb8802e3d33e4448bb4e4b56a01de2e1f). If immediate upgrade is not possible, the practical compensating control is to restrict who holds the edit_work_packages permission and to review project role definitions so that users with edit rights are trusted, since exploitation requires that permission; where feasible, disabling or removing external file storage integrations eliminates the FileLink records that can be manipulated, at the cost of losing document-linking functionality. Consult the GitHub Security Advisory GHSA-c6rc-4288-8p4f (https://github.com/opf/openproject/security/advisories/GHSA-c6rc-4288-8p4f) for authoritative guidance.