CVE-2026-112001
CVE-2026-112001 · ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.
CVSS 8.6 · Alta · EPSS 0,6% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
projectsend
- Versiones
- ≥ 2.0.0, < 2.7.0: Afectada (semver)
Actualiza a 2.7.0
Fuentes originales
- https://github.com/projectsend/projectsend/security/advisories/GHSA-j5cp-r8pr-m5cr
- https://github.com/projectsend/projectsend/commit/db65731c3ad28ac7f0d541c60cb65eb100958514
- https://github.com/projectsend/projectsend/releases/tag/v2.7.0
- https://github.com/projectsend/projectsend/blob/v2.6.0/app/Modules/Identity/StaffAccounts.php#L153-L162
- https://www.vulncheck.com/advisories/projectsend-2.0.0-before-2.7.0-incorrect-authorization-via-users-api-token-abilities
- https://nvd.nist.gov/vuln/detail/CVE-2026-112001