CVE-2026-116136
Deferred Deferred - Pending Action

Authorization Bypass in ProjectSend via FileVersion Linking

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an intermediate revision or assign out-of-scope clients, causing moveAssignmentsToRoot() to expose protected original files to unauthorized clients.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116136
EUVD
EUVD-2026-109388

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
projectsend ProjectSend 2.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in ProjectSend 2.0.0 through 2.7.1 allows staff users to improperly share files by linking file versions. Attackers can link their file to an intermediate revision or assign out-of-scope clients, causing the system to expose protected original files to unauthorized users. The flaw exists in the FileVersions::link() function and involves incorrect authorization checks.

Detection Guidance

To detect this vulnerability, inspect ProjectSend installations for versions 2.0.0 through 2.7.1. Check FileVersions.php for the FileVersions::link() function and verify if authorization checks are missing in the guard() method. Look for improper file sharing where staff users can link files to intermediate revisions or assign out-of-scope clients.

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to sensitive files. Staff users might unintentionally share protected files with unintended recipients, including external clients. This could lead to data leaks, unauthorized file access, or compliance violations depending on the file contents.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. If files containing personal or health data are exposed, organizations may face legal penalties, fines, or reputational damage due to non-compliance with data protection regulations.

Mitigation Strategies

Immediately update ProjectSend to the latest patched version. If updating is not possible, apply the patch from commit a6ce4f51cfd05e1c9895f8daed261ef1fdfd194d. Ensure the guard() method in FileVersions.php includes checks for staff permissions and recipient validation before linking files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116136. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart