CVE-2026-112001 Details
Description
ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.
A vulnerability exists in ProjectSend versions 2.0.0 prior to 2.7.0, allowing restricted API token holders to improperly change the credentials of the token owner. This issue arises from an incorrect authorization mechanism that fails to enforce proper checks when tokens with limited abilities are used to modify sensitive information. Specifically, tokens restricted to 'manage_users' and 'edit_users' can be exploited to change an owner's password, remove two-factor authentication, and gain full access to the owner's role permissions through an interactive login.
Users are advised to update to ProjectSend version 2.7.0, where this vulnerability has been patched. After updating, ensure that API tokens do not include 'edit_clients' or the combination of 'manage_users' and 'edit_users' unless the holder is fully trusted with the accounts involved.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ProjectSend | >= 2.0.0, <= 2.6.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |