Vulnerability · Published Oct 18, 2026 · Assigned by VulnCheck

CVE-2026-112001ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities

High 7.2

In plain English

A high-severity incorrect authorization in ProjectSend from ProjectSend. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.6%top 50.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.

Affected products (as reported)

Vendor	Product	Versions
ProjectSend	ProjectSend	2.0.0 – before 2.7.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-j5cp-r8pr-m5cr) vendor-advisory
https://github.com/projectsend/projectsend/commit/db65731c3ad28ac7f0d541c60cb65eb100958514 patch
ProjectSend v2.7.0 Release Notes release-notes
https://github.com/projectsend/projectsend/blob/v2.6.0/app/Modules/Identity/StaffAccounts.php#L153-L162 technical-description
VulnCheck Advisory: ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities third-party-advisory