Vulnerability · Published Mar 12, 2026 · Assigned by VulDB

CVE-2026-3977projectsend AJAX Endpoints authorization

Medium 6.3

In plain English

A medium-severity missing authorization in projectsend. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.3%top 78.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in projectsend up to r1945. The affected element is an unknown function of the component AJAX Endpoints. The manipulation leads to missing authorization. The attack can be initiated remotely. The identifier of the patch is 35dfd6f08f7d517709c77ee73e57367141107e6b. To fix this issue, it is recommended to deploy a patch.

Affected products (as reported)

Vendor	Product	Versions
n/a	projectsend	r1945

Weakness: CWE-862, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

References

VDB-350412 | projectsend AJAX Endpoints authorization vdb-entry
VDB-350412 | CTI Indicators (IOB, IOC) signature, permissions-required
https://github.com/projectsend/projectsend/issues/1525 issue-tracking
https://github.com/projectsend/projectsend/issues/1525#issuecomment-3957109914 issue-tracking
https://github.com/projectsend/projectsend/commit/35dfd6f08f7d517709c77ee73e57367141107e6b patch
https://github.com/projectsend/projectsend/ product