CVE-2026-67527

This vulnerability exposes a structural flaw in OpenProject's permission architecture, not merely an implementation oversight. The core issue: the edit_work_packages permission implicitly bypassed manage_file_links, allowing authenticated users to perform file link operations they shouldn't have access to through the work package PATCH endpoint. When editing a work package via PATCH /api/v3/work_packages/{id}, the endpoint accepted _links.fileLinks as a first-class attribute. It processed detachment, deletion, and cross-project re-parenting of file links as incidental mutations rather than privileged operations. Two semantically separate permissions were designed as independent gates when one should have been a prerequisite for the other. The cross-project re-parenting capability is what elevates this from a simple data leak to a reconnaissance and lateral movement vector. An attacker with edit_work_packages on any work package could pull FileLinks owned by other projects into their scope, exposing metadata — origin filenames, origin IDs, MIME types — that reveal internal project naming conventions, file store structures, and relationships between projects. You don't just read data; you reshape the attachment graph and learn about systems you shouldn't access. Check your OpenProject version. If you're on 17.5.x or earlier, the PATCH endpoint accepts arbitrary file link IDs without verifying manage_file_links. After upgrading to 17.6.0, verify that the fix adds the permission check without breaking legitimate workflows where work package editors legitimately need to manage attached files. Beyond patching, audit your API surface for other attributes in PATCH handlers that may similarly bypass permission checks by treating privileged operations as incidental attribute mutations. The vulnerability wasn't a bad code decision — it was a design assumption failure where the work package team treated file links as parent-resource attributes while the storage team treated them as standalone objects with their own permission model.

Reviewed through automated stages and approved by a human before publication.