CVE-2026-112001: ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities
ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manageusers and editusers can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ProjectSendto a version that resolves this vulnerability.Fixed in 2.7.0
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs an API token belonging to a ProjectSend user that is limited to the manage_users and edit_users abilities. They can use that token to modify the token owner's account, rather than needing the owner's interactive password.
What is the practical impact of successful exploitation?
The attacker can set a new password for the token owner and clear that user's two-factor authentication. They can then sign in interactively as the owner with the full permissions associated with that user's role.
Which versions are affected?
ProjectSend versions from 2.0.0 before 2.7.0 are affected. Version 2.7.0 is identified as the release containing the fix.
How can I check whether an account may have been compromised through this issue?
Review use of PATCH requests to /api/v1/users/{user}, particularly those made with tokens having manage_users and edit_users abilities. Investigate unexpected password changes, two-factor authentication resets, and subsequent interactive sign-ins for the affected token owner.