CVE-2026-112002highCWE-620

CVE-2026-112002: falha de alta gravidade em ProjectSend

ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar ProjectSend

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.6epss 0.3%
ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create a durable local password, enroll their own second factor, and persistently take over the account.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
ProjectSend · ProjectSend
CVEs relacionadas — ProjectSend

No mesmo produto, das mais perigosas para as menos.

CVE-2024-11680CRITICALProjectSend Unauthenticated Configuration ModificationEPSS 91.8%KEVCVE-2026-112001HIGHProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token AbilitiesEPSS 0.6%CVE-2026-112003MEDIUMProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/DeleteEPSS 0.4%CVE-2026-53992MEDIUMReflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date ParametersEPSS 0.4%