high7.2
CVE-2026-112001
ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentia…
Impact
ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.
Affected products
| Product | Affected versions |
|---|---|
| ProjectSend 2.0.0 | before 2.7.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/projectsend/projectsend/blob/v2.6.0/app/Modules/Identity/StaffAccounts.php#L153-L162
- https://github.com/projectsend/projectsend/commit/db65731c3ad28ac7f0d541c60cb65eb100958514
- https://github.com/projectsend/projectsend/releases/tag/v2.7.0
- https://github.com/projectsend/projectsend/security/advisories/GHSA-j5cp-r8pr-m5cr
- https://www.vulncheck.com/advisories/projectsend-2.0.0-before-2.7.0-incorrect-authorization-via-users-api-token-abilities