{"id":"CVE-2026-112001","title":"ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities","summary":"ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_us…","severity":"high","cvss":7.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-863"],"vendor":"ProjectSend","product":"ProjectSend","affected":["ProjectSend >= 2.0.0 < 2.7.0"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T11:38:26.451Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112001","references":[{"url":"https://github.com/projectsend/projectsend/security/advisories/GHSA-j5cp-r8pr-m5cr","label":"GitHub Security Advisory (GHSA-j5cp-r8pr-m5cr)"},{"url":"https://github.com/projectsend/projectsend/commit/db65731c3ad28ac7f0d541c60cb65eb100958514"},{"url":"https://github.com/projectsend/projectsend/releases/tag/v2.7.0","label":"ProjectSend v2.7.0 Release Notes"},{"url":"https://github.com/projectsend/projectsend/blob/v2.6.0/app/Modules/Identity/StaffAccounts.php#L153-L162"},{"url":"https://www.vulncheck.com/advisories/projectsend-2.0.0-before-2.7.0-incorrect-authorization-via-users-api-token-abilities","label":"VulnCheck Advisory: ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T11:40:26.625Z","slug":"CVE-2026-112001","body":"## Overview\n\nProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.\n\n## Affected\n\n- `ProjectSend >= 2.0.0 < 2.7.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":39.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}