CVE-2026-116136: falha de média gravidade em ProjectSend
ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6epss 0.2%
ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an intermediate revision or assign out-of-scope clients, causing moveAssignmentsToRoot() to expose protected original files to unauthorized clients.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
projectsend · ProjectSendReferências
https://github.com/projectsend/projectsendhttps://github.com/projectsend/projectsend/blob/v2.7.1/app/Modules/Files/Versions/FileVersions.php#L456-L467https://github.com/projectsend/projectsend/blob/v2.7.1/app/Modules/Files/Versions/FileVersions.php#L534-L575https://github.com/projectsend/projectsend/commit/a6ce4f51cfd05e1c9895f8daed261ef1fdfd194dhttps://www.vulncheck.com/advisories/projectsend-2.0.0-through-2.7.1-incorrect-authorization-via-file-version-linking