CVE-2026-7144: 1000 Projects Portfolio Management System MCA update_passwd_process.php authorization
A security flaw has been discovered in 1000 Projects Portfolio Management System MCA 1.0. This impacts an unknown function of the file updatepasswdprocess.php. The manipulation of the argument tempuser results in authorization bypass. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7144?
CVE-2026-7144 has been assessed as a medium severity vulnerability due to its potential impact on user account security.
How do I fix CVE-2026-7144?
To fix CVE-2026-7144, ensure proper authorization checks are implemented in the update_passwd_process.php file.
What systems are affected by CVE-2026-7144?
CVE-2026-7144 affects version 1.0 of the 1000 Projects Portfolio Management System MCA.
What kind of exploit is associated with CVE-2026-7144?
CVE-2026-7144 can be exploited through unauthorized access to user account functionality via the temp_user argument in the affected script.
Is there a workaround for CVE-2026-7144?
A temporary workaround for CVE-2026-7144 is to restrict access to the update_passwd_process.php file until a patch is applied.