CVE-2026-112002 Details
Description
ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create a durable local password, enroll their own second factor, and persistently take over the account.
A vulnerability exists in ProjectSend versions 2.5.0 prior to 2.7.0, allowing sessions of Social-provisioned accounts to change passwords without the current password. This unverified password change vulnerability is located in the PasswordController's update method. Attackers with a stolen session cookie can exploit this by sending a PUT request to /settings/password, thereby creating a permanent local password. Once the password is set, they can enroll a second factor for authentication and take over the account permanently.
Users can update to ProjectSend version 2.7.0, which addresses this vulnerability by requiring a verified recovery proof or fresh authentication with the linked provider before allowing a password change.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-620 | Unverified Password Change | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ProjectSend | >= 2.5.0, <= 2.6.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |