Live › vulnerability › CVE-2026-112001
Go to dashboardProjectSend versions from 2.0.0 before 2.7.0 let a restricted API token change the token owner's password and clear two-factor authentication via PATCH /api/v1/users/{user}. An attacker can then sign in interactively with the owner's full role permissions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any ProjectSend instance running a version from 2.0.0 before 2.7.0 that issues API tokens with manage_users and edit_users scopes is exposed. Instances without API tokens issued to restricted roles, or already on 2.7.0 or later, are not affected by this flaw.
No product ranges from the sources yet.
2.7.0 are affected.manage_users and edit_users permissions.2.7.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.
This page as .md · .json · in your agent: get_signal("CVE-2026-112001")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.