CVE-2026-112002: ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password
ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create a durable local password, enroll their own second factor, and persistently take over the account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ProjectSendto a version that resolves this vulnerability.Fixed in 2.7.0
Event History
Frequently Asked Questions
Which accounts are exposed to this attack?
The affected account must be Social-provisioned and have an active session that an attacker can steal. The issue affects ProjectSend versions from 2.5.0 up to, but not including, 2.7.0.
What does an attacker need to exploit this vulnerability?
An attacker needs a stolen session cookie for a Social-provisioned account. They can then send a PUT request to /settings/password without knowing the current password.
What persistence can an attacker establish after using a stolen session?
The attacker can set a local password for the account and enroll their own second factor. This can preserve access even after the stolen session would otherwise no longer be usable.
What should be done if affected?
Upgrade ProjectSend to version 2.7.0 or later. For potentially compromised Social-provisioned accounts, investigate password changes and second-factor enrollments for signs of unauthorized persistence.