CVE-2026-67527
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In OpenProject prior to version 17.6.0, the PATCH /api/v3/work_packages/{id} endpoint accepts _links.fileLinks and allows authenticated users with edit_work_packages but without manage_file_links to resolve Storages::FileLink records by raw id, detach or hard-delete existing FileLinks, and re-parent FileLinks from other projects to an attacker-controlled work package, exposing origin filename, origin id, and MIME type metadata.
Risk Assessment
The risk involves unauthorized access to file metadata and manipulation of file links, potentially compromising data confidentiality and integrity across projects.
Recommendation
It is recommended to update OpenProject to version 17.6.0 or later, which includes a fix restricting access to FileLink operations.
Other vulnerabilities in OpenProject
See all- CVE-2026-22601High
OpenProject is an open-source, web-based project management software. In version 16.6.1 and below, a registered administrator can execute arbitrary commands by configuring the sendmail binary path and sending a test email. This issue has been patched in version 16.6.2.
- CVE-2017-11667High
OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, allowing remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session.
- CVE-2026-52785Critical
OpenProject before versions 17.3.3 and 17.4.1 contains a SQL injection vulnerability in the timestamps functionality. Attackers can exploit the timestamps parameter to execute unauthorized database queries.
- CVE-2026-52782Critical
In OpenProject prior to versions 17.3.3 and 17.4.1, an IDOR vulnerability exists in the endpoint /projects/<A>/settings/project_storages/<A_ps_id> via the PATCH parameter "storages_project_storage[project_folder_id]". A project administrator can hijack the managed Nextcloud or OneDrive folder of another project on the same storage, leading to unauthorized resource access.
- CVE-2026-46386Critical
The official openproject/openproject Docker image ships with a default SECRET_KEY_BASE=OVERWRITE_ME, which combined with cookies_serializer = :marshal allows any logged-in user a deterministic Marshal-deserialization path via the /my/two_factor_devices cookie reader. This vulnerability is fixed in a later version.
- CVE-2026-34717Critical
OpenProject prior to version 17.2.3 has an SQL injection vulnerability in the =n operator in modules/reporting/lib/report/operator.rb:177. This operator embeds user input directly into SQL WHERE clauses without parameterization.
- CVE-2026-22600Critical
OpenProject before version 16.6.4 contains a Local File Read vulnerability in the work package PDF export. By uploading a specially crafted SVG file (disguised as PNG) as an attachment, an attacker can exploit the ImageMagick engine to read arbitrary local files accessible to the application user.
- CVE-2026-55095Medium
OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw custom_field_ project attribute. The dialog path resolves the project custom field by its raw identifier without enforcing the normal admin_only visibility scope and renders the stored custom-field comment in read-only mode. This discloses hidden comment text but does not disclose the custom-field value or permit writes or mutation. This issue is reported as fixed in version 17.6.0.
- CVE-2026-67529Medium
OpenProject before 17.6.0 in GET /api/v3/time_entries and GET /api/v3/cost_entries exposed private work package titles and IDs without visibility checks. Users with view_time_entries or view_cost_entries could read this data.
- CVE-2026-67528Medium
OpenProject before 17.6.0 in GET /api/v3/custom_options/:id resolved custom options by global numeric ID without visibility checks. Authenticated non-admin users could enumerate IDs and read labels of admin-only options.
Original NVD description (English source)
OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/work_packages/{id} accepted _links.fileLinks and allowed authenticated users with edit_work_packages but without manage_file_links to resolve Storages::FileLink records by raw id, detach or hard-delete existing FileLinks, and re-parent FileLinks from other projects to an attacker-controlled work package, exposing origin filename, origin id, and MIME type metadata. This issue is fixed in 17.6.0.