Incomplete Authorization in ProjectSend Allows Unauthorized File Sharing
CVE-2026-116136

6MEDIUM

Key Information:

Vendor

Projectsend

Status
Projectsend
Vendor
CVE Published:
25 October 2026

What is CVE-2026-116136?

ProjectSend versions 2.0.0 through 2.7.1 are impacted by an incomplete authorization vulnerability within the FileVersions::link() function. This flaw permits staff users to share files without proper authorization by linking versions of files. Attackers can exploit this by associating files with intermediate revisions or linking out-of-scope clients, resulting in the moveAssignmentsToRoot() function revealing original files protected from unauthorized access. This presents a significant risk, allowing unauthorized clients to access sensitive information.

Affected Version(s)

ProjectSend 2.0.0 <= 2.7.1

References

https://github.com/projectsend/projectsend/commit/a6ce4f5...
patch
https://github.com/projectsend/projectsend
product
https://github.com/projectsend/projectsend/blob/v2.7.1/ap...
technical-description

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Huzaifa Dal
.