{"id":"CVE-2026-112002","title":"ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password","summary":"ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a s…","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-620"],"vendor":"ProjectSend","product":"ProjectSend","affected":["ProjectSend >= 2.5.0 < 2.7.0"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T11:38:27.111Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112002","references":[{"url":"https://github.com/projectsend/projectsend/security/advisories/GHSA-4r8h-mwfm-f5f4","label":"GitHub Security Advisory (GHSA-4r8h-mwfm-f5f4)"},{"url":"https://github.com/projectsend/projectsend/commit/717852ff6a99391dbd816a2bb0bb3f40cad70f72"},{"url":"https://github.com/projectsend/projectsend/releases/tag/v2.7.0","label":"ProjectSend v2.7.0 Release Notes"},{"url":"https://github.com/projectsend/projectsend/blob/v2.6.0/app/Http/Controllers/Settings/PasswordController.php#L54-L90"},{"url":"https://www.vulncheck.com/advisories/projectsend-2.5.0-before-2.7.0-unverified-password-change-via-settings-password","label":"VulnCheck Advisory: ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T11:40:26.624Z","slug":"CVE-2026-112002","body":"## Overview\n\nProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create a durable local password, enroll their own second factor, and persistently take over the account.\n\n## Affected\n\n- `ProjectSend >= 2.5.0 < 2.7.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}