CVE-2026-112001highCWE-863

CVE-2026-112001: falha de alta gravidade em ProjectSend

ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar ProjectSend

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.6epss 0.6%
ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
ProjectSend · ProjectSend
CVEs relacionadas — ProjectSend

No mesmo produto, das mais perigosas para as menos.

CVE-2024-11680CRITICALProjectSend Unauthenticated Configuration ModificationEPSS 91.8%KEVCVE-2026-112003MEDIUMProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/DeleteEPSS 0.4%CVE-2026-53992MEDIUMReflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date ParametersEPSS 0.4%CVE-2026-112002HIGHProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/passwordEPSS 0.3%