Read the docs
TI-2026-76153 Aliases CVE-2026-112001GHSA-7c3c-3r99-phc3

ProjectSend users API flaw lets token holders take over accounts

Priority HIGH 72CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

ProjectSend from 2.0.0 before 2.7.0 contains an incorrect authorization flaw (CWE-863) in the users API. An attacker holding an API token limited to manage_users and edit_users can change the token owner's credentials through PATCH /api/v1/users/{user}, then sign in with that owner's full role permissions. The attacker needs a restricted API token, and the flaw has a high CVSS 4.0 base score of 8.6.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00617 49th percentileScored 2026-11-07
Fix Fixed ProjectSend (ProjectSend): 2.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ProjectSendProjectSend2.0.0 to before 2.7.02.7.0Patch availableCNA
  • ProjectSend VendorProjectSend Affected 2.0.0 to before 2.7.0 Fixed in 2.7.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:*——ProjectSend
  • cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:* Versions — — ·ProjectSend

Remediation

Update ProjectSend to version 2.7.0 or later, which is the fixed version for the affected 2.0.0 before 2.7.0 range.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA ProjectSend (ProjectSend) Fixed in 2.7.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    ProjectSend 2.7.0

    3 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-76155 ProjectSend Path Validation Bypass via Orphan File Import and DeletePriority MEDIUM 60
    • TI-2026-76154 Unverified password change in ProjectSend lets attackers take over accountsPriority LOW 35
    Show all 3 records →

Timeline

  1. 2026-10-18 Threatist record created from CVE-2026-112001
  2. 2026-10-18 Alias added: GHSA-7c3c-3r99-phc3
  3. 2026-10-19 CISA SSVC decision points changed
  4. 2026-10-19 Priority changed: MEDIUM → HIGH

References

Patch 1

Advisory 1

Other 2

  • TI-2024-10826 ProjectSend Unauthenticated Configuration Modification KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-30263 ProjectSend r1605 Remote Code Execution via File Extension Manipulation CVSS 4.0HIGH 8.7
  • TI-2023-30213 ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability CVSS 4.0HIGH 7.1
  • TI-2014-07764 Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly… CVSS 2.0HIGH 7.5
  • TI-2023-30188 ProjectSend r1605 CSV Injection via User Account Export Functionality CVSS 4.0MEDIUM 6.2
  • TI-2026-76155 ProjectSend Path Validation Bypass via Orphan File Import and Delete CVSS 4.0MEDIUM 6.0
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences