CVE-2026-112001
CVE-2026-112001 · ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities
This page contains facts from public vulnerability sources. Check the original advisory before updating.
ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.
CVSS 8.6 · High · EPSS 0.5% · Fix available
- Published
- Updated
Affected products and versions
projectsend
- Versions
- ≥ 2.0.0, < 2.7.0: Affected (semver)
Update to 2.7.0
Original sources
- https://github.com/projectsend/projectsend/security/advisories/GHSA-j5cp-r8pr-m5cr
- https://github.com/projectsend/projectsend/commit/db65731c3ad28ac7f0d541c60cb65eb100958514
- https://github.com/projectsend/projectsend/releases/tag/v2.7.0
- https://github.com/projectsend/projectsend/blob/v2.6.0/app/Modules/Identity/StaffAccounts.php#L153-L162
- https://www.vulncheck.com/advisories/projectsend-2.0.0-before-2.7.0-incorrect-authorization-via-users-api-token-abilities
- https://nvd.nist.gov/vuln/detail/CVE-2026-112001