CVE-2026-112001
highProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentia…
ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/projectsend/projectsend/blob/v2.6.0/app/Modules/Identity/StaffAccounts.... disclosure@vulncheck.com
- https://github.com/projectsend/projectsend/commit/db65731c3ad28ac7f0d541c60cb65eb100958514 disclosure@vulncheck.com
- https://github.com/projectsend/projectsend/releases/tag/v2.7.0 disclosure@vulncheck.com
- https://github.com/projectsend/projectsend/security/advisories/GHSA-j5cp-r8pr-m5cr disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/projectsend-2.0.0-before-2.7.0-incorrect-authorizatio... disclosure@vulncheck.com
- https://github.com/projectsend/projectsend/security/advisories/GHSA-j5cp-r8pr-m5cr 134c704f-9b21-4f2e-91b3-4a467353bcc0