Incorrect Authorization in ProjectSend Affects User Credential Security
CVE-2026-112001

8.6HIGH

Key Information:

Vendor

Projectsend

Status
Projectsend
Vendor
CVE Published:
18 October 2026

What is CVE-2026-112001?

ProjectSend prior to version 2.7.0 exhibits an incorrect authorization flaw that allows users with limited API tokens to alter the credentials of token owners. This vulnerability enables attackers to reset the owner's password, disable two-factor authentication, and gain full access to the owner's account through interaction. This poses a significant risk to user security and data integrity.

Affected Version(s)

ProjectSend 2.0.0 < 2.7.0

References

https://github.com/projectsend/projectsend/security/advis...
vendor-advisory
https://github.com/projectsend/projectsend/commit/db65731...
patch
https://github.com/projectsend/projectsend/releases/tag/v...
release-notes

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

WHS4th Team TokenManiZo
.