TI-2026-76154 Aliases CVE-2026-112002 GHSA-xr56-2553-vh5p

Unverified password change in ProjectSend lets attackers take over accounts

LOW 35CWE-620Published 2026-10-18 · Updated 2026-10-19

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

ProjectSend from 2.5.0 before 2.7.0 contains an unverified password change flaw in PasswordController::update() (CWE-620). A session of an account provisioned through Social login can set a local password without providing the current password. An attacker holding a stolen session cookie can create a durable local password, enroll their own second factor, and keep control of the account.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create a durable local password, enroll their own second factor, and persistently take over the account.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0029 21st percentileScored 2026-11-07

Fix Fixed ProjectSend (ProjectSend): 2.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ProjectSend	ProjectSend	2.5.0 to before 2.7.0	2.7.0	Patch available	CNA

ProjectSend VendorProjectSend Affected 2.5.0 to before 2.7.0 Fixed in 2.7.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:projectsend:projectsend::::::::	—	—	ProjectSend

cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:* Versions — — ·ProjectSend

Remediation

Upgrade ProjectSend to version 2.7.0.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA ProjectSend (ProjectSend) Fixed in 2.7.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-18
ProjectSend 2.7.0
3 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-76153 ProjectSend users API flaw lets token holders take over accountsPriority HIGH 72
- TI-2026-76155 ProjectSend Path Validation Bypass via Orphan File Import and DeletePriority MEDIUM 60
Show all 3 records →

Timeline

2026-10-18 Threatist record created from CVE-2026-112002
2026-10-18 Alias added: GHSA-xr56-2553-vh5p
2026-10-19 CISA SSVC decision points changed
2026-10-19 Priority changed: MEDIUM → LOW

References

Patch 1

https://github.com/projectsend/projectsend/commit/717852ff6a99391dbd816a2bb0bb3f40cad70f72

Advisory 1

GitHub Security Advisory (GHSA-4r8h-mwfm-f5f4)

Other 2

TI-2024-10826 ProjectSend Unauthenticated Configuration Modification KEVCVSS 3.1CRITICAL 9.8
TI-2023-30263 ProjectSend r1605 Remote Code Execution via File Extension Manipulation CVSS 4.0HIGH 8.7
TI-2026-76153 ProjectSend users API flaw lets token holders take over accounts CVSS 4.0HIGH 8.6
TI-2023-30213 ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability CVSS 4.0HIGH 7.1
TI-2014-07764 Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly… CVSS 2.0HIGH 7.5
TI-2023-30188 ProjectSend r1605 CSV Injection via User Account Export Functionality CVSS 4.0MEDIUM 6.2

See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences