Unverified Password Change Vulnerability in ProjectSend by ProjectSend

CVE-2026-112002

What is CVE-2026-112002?

An unverified password change vulnerability exists in ProjectSend versions prior to 2.7.0. This flaw allows attackers with access to stolen session cookies to change the password of social-provisioned accounts without needing the current password. By exploiting this vulnerability through a malicious PUT request to /settings/password, they can create a new local password, set up their second factor for authentication, and gain persistent access to the compromised account, leading to potential unauthorized actions within the application.

References