Technical impact
The vulnerability arises when an authenticated user with the edit_work_packages permission, but lacking the manage_file_links privilege, sends a PATCH request to /api/v3/work_packages/{id} with the _links.fileLinks parameter. This allows the user to resolve Storages::FileLink records by raw id, detach or hard‑delete existing file links, and re‑parent file links from other projects into the attacker‑controlled work package. As a result, the user can expose origin filenames, origin IDs, and MIME type metadata that should otherwise be inaccessible, and can potentially manipulate project data structure. The weakness is an improper access control flaw (CWE‑862).
Affected Systems
OpenProject, the open‑source web‑based project management platform, is affected in all releases prior to version 17.6.0. Users running versions older than 17.6.0 on any operating system that hosts the OpenProject instance are susceptible unless the role that grants edit_work_packages is tightly restricted.
Risk and Exploitability
The CVSS score of 7.6 indicates a moderate to high severity. The EPSS score of less than 1% suggests a low likelihood that the vulnerability is being exploited in the wild at present, and it is not listed in the CISA KEV catalog. However, it can be exploited by any authenticated user who has edit_work_packages permission but not manage_file_links, a commonly granted role in many OpenProject deployments. If an attacker can manipulate file links, they may expose sensitive metadata or alter project organization, potentially leading to information disclosure or disruption of project data integrity.
