A vulnerability in OpenProject prior to version 17.6.0 allows authenticated users with edit_work_packages permission but without manage_file_links permission to abuse the PATCH /api/v3/work_packages/{id} API endpoint. Attackers can resolve Storages::FileLink records by raw ID, detach or hard-delete existing FileLinks, and re-parent FileLinks from other projects to an attacker-controlled work package. This improper authorization flaw exposes sensitive metadata including origin filename, origin ID, and MIME type. The vulnerability stems from insufficient permission checks on the _links.fileLinks field accepted by the API. A fix has been released in OpenProject version 17.6.0. The issue is tracked as CVE-2026-67527 and documented in GitHub security advisory GHSA-c6rc-4288-8p4f.