Executive brief
OpenProject is an open-source project management platform. A security flaw in the software's API allowed users with basic editing permissions to manipulate file links they should not have access to. An attacker could use this to view file metadata (like filenames), detach files from projects, or move files from other projects into their own, potentially leading to data leakage or disruption of project documentation.
Technical details
A missing authorization check (CWE-862) exists in the 'PATCH /api/v3/work_packages/{id}' endpoint. While the endpoint accepted '_links.fileLinks', it failed to verify if the authenticated user possessed the 'manage_file_links' permission. An attacker with 'edit_work_packages' permissions could resolve 'Storages::FileLink' records by their raw ID to detach or hard-delete them. Furthermore, attackers could re-parent FileLinks from other projects to a work package they control, thereby exposing metadata such as origin filenames, IDs, and MIME types. This issue was addressed in version 17.6.0 by moving file link manipulation to the storages module and enforcing consistent validation patterns.
Affected products
- opf OpenProject < 17.6.0
Timeline
- 2026-06-19: patched: Fix committed to repository
- 2026-07-08: advisory: Version 17.6.0 released
- 2026-07-30: disclosed: CVE published