Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-112001: ProjectSend API tokens let limited users reset passwords

CVE-2026-112001 · published 13 days ago

Summary

In ProjectSend versions before 2.7.0, a token that was supposed to have only limited rights can be used to change the password and two‑factor settings of the token's owner. This lets an attacker sign in with full administrator permissions. Update ProjectSend to version 2.7.0 or later, or remove any unused API tokens and enforce strong token management.

What to do

Update projectsend projectsend to version 2.7.0 or later.

Affected software

Vendor	Product	Affected versions
projectsend	projectsend	< 2.7.0

Original advisory text

ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.

References

https://www.vulncheck.com/advisories/projectsend-2.0.0-before-2.7.0-incorrect-au... Vendor Advisory
https://github.com/projectsend/projectsend/commit/db65731c3ad28ac7f0d541c60cb65e... Patch
https://github.com/projectsend/projectsend/blob/v2.6.0/app/Modules/Identity/Staf... Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-1120... Vendor Advisory
https://github.com/projectsend/projectsend Product
https://github.com/projectsend/projectsend/releases/tag/v2.7.0 Vendor Advisory
https://github.com/projectsend/projectsend/security/advisories/GHSA-j5cp-r8pr-m5... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-112001 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.4 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-863Incorrect Authorization

Timeline

Published18 Oct 2026

Updated30 Oct 2026

First seen18 Oct 2026

Sources

CVE-2026-112001 · NVD

CVE-2026-112001 · MITRE

CVE-2026-112001 · OSV

GHSA-j5cp-r8pr-m5cr · GHSA

Track software like this

Free during beta