CVE-2026-116136: ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking
ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an intermediate revision or assign out-of-scope clients, causing moveAssignmentsToRoot() to expose protected original files to unauthorized clients.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker needs staff-level access to ProjectSend. The issue is exploitable by staff users who can link file versions and use that capability to assign clients outside their authorized scope.
What can an attacker expose through this vulnerability?
By linking a file to an intermediate revision or assigning out-of-scope clients, an attacker can cause protected original files to be exposed to unauthorized clients. The impact includes disclosure of protected file contents.
Are ProjectSend deployments in the affected version range exposed by default?
The available information identifies ProjectSend versions 2.0.0 through 2.7.1 as affected, but does not state whether a particular default configuration prevents or enables exploitation. Exploitation requires a staff account and the ability to link file versions.