PT-2026-116605 · Unknown · Projectsend
CVE-2026-112001
·
Published
2026-10-18
·
Updated
2026-10-18
CVSS v4.0
8.6
High
| Vector | AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
ProjectSend versions 2.0.0 through 2.6.9
Description
An incorrect authorization issue allows holders of restricted API tokens to modify the credentials of the token owner. By using the 'PATCH /api/v1/users/{user}' endpoint, attackers possessing tokens with
manage users and edit users permissions can reset the owner's password and disable two-factor authentication, enabling them to log in with the owner's full administrative privileges.Recommendations
Update ProjectSend to version 2.7.0 or later.
Exploit
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Projectsend