CVE-2026-112001
Deferred Deferred - Pending Action

Incorrect Authorization in ProjectSend Allows Privilege Escalation via API

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: VulnCheck

Description
ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-112001
EUVD
EUVD-2026-103454

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ProjectSend ProjectSend 2.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-112001 is an incorrect authorization vulnerability in ProjectSend versions 2.0.0 to 2.6.0. It allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with limited tokens (e.g., manage_users+edit_users) can reset passwords, disable two-factor authentication, and gain full interactive access to the owner's account.

Detection Guidance

To detect this vulnerability, check ProjectSend versions running on your system. Versions 2.0.0 through 2.6.0 are vulnerable. Use commands like 'grep -r "ProjectSend" /path/to/install' or check the version in the application interface or database. Review API logs for suspicious PATCH requests to /api/v1/users/{user} that modify credentials or disable 2FA.

Impact Analysis

This vulnerability allows attackers to escalate privileges, access sensitive files, and perform administrative actions. For example, an attacker with a limited token could reset an administrator's password, disable 2FA, and gain full control of the system. It also enables unauthorized access to client data and files.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR (data protection) and HIPAA (health information privacy). Unauthorized access may result in data breaches, legal penalties, and loss of trust. Organizations using ProjectSend must ensure proper authorization controls to meet regulatory standards.

Mitigation Strategies

Upgrade ProjectSend to version 2.7.0 or later immediately. If upgrading is not possible, revoke all API tokens with manage_users or edit_users permissions. Disable the ability for tokens to modify account ownership details. Require manual password resets via email and enforce current password confirmation for credential changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112001. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart