OpenProject versions prior to 17.3.3 (for the 17.x line) and prior to 17.4.1 contain a direct‑unlinking of IDOR vulnerability. A project‑administrator can modify the "storages_project_storage[project_folder_id]" PATCH parameter on the endpoint /projects/<A>/settings/project_storages/<A_ps_id> to point a storage entity to a folder belonging to another project. The next automatic sync of that storage overwrites the access control list of the target folder with the attacker project’s user list, effectively granting the attacker all users of the target project access to that folder. The flaw directly results in unauthorized disclosure or manipulation of project resources.

The affected product is OpenProject, a web‑based project management platform. All installations running any version prior to 17.3.3 for the 17.x series or prior to 17.4.1 are vulnerable. No other versions are listed as affected.

The CVSS score is 9.9, indicating critical severity. EPSS data is not provided, but the flaw requires an authenticated project‑administrator, which may limit the number of potential attackers. It is not listed in the CISA KEV catalog. An attacker must have administrative permissions on a project and must be able to send authenticated PATCH requests to the vulnerable endpoint. Once exploited, the attacker gains full access to the target project’s storage folder, enabling data exposure or modification.