{"id":"CVE-2026-112001","kind":"vulnerability","aliases":["CVE-2026-112001"],"related":[],"title":"ProjectSend: restricted API token can take over owner account","description":"ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.","summary":"ProjectSend versions from 2.0.0 before 2.7.0 let a restricted API token change the token owner's password and clear two-factor authentication via PATCH /api/v1/users/{user}. An attacker can then sign in interactively with the owner's full role permissions.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","projectsend","self-hosted"],"not_affected_if":["already-on-2.7.0","no-api-tokens"],"how_to_check":"- Check the installed ProjectSend version; versions below `2.7.0` are affected.\n- Review API tokens that hold `manage_users` and `edit_users` permissions.","fix":"- Upgrade ProjectSend to `2.7.0` or later.\n- Rotate passwords and API tokens for owner accounts if the instance ran an affected version with exposed tokens.","status":"open","published_at":"2026-10-18T12:17:12+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T03:00:01+00:00","updated_at":"2026-10-25T03:00:01+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:00:01Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ProjectSend to `2.7.0` or later.\n- Rotate passwords and API tokens for owner accounts if the instance ran an affected version with exposed tokens.","reach":"internet","title":"ProjectSend: restricted API token can take over owner account","impact":"high","summary":"ProjectSend versions from 2.0.0 before 2.7.0 let a restricted API token change the token owner's password and clear two-factor authentication via PATCH /api/v1/users/{user}. An attacker can then sign in interactively with the owner's full role permissions.","category":"package","nicknames":[],"who_cares":["projectsend","self-hosted","php"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker takes over the owner account and its full permissions.","analyst_note":"","how_to_check":"- Check the installed ProjectSend version; versions below `2.7.0` are affected.\n- Review API tokens that hold `manage_users` and `edit_users` permissions.","needs_analyst":false,"not_affected_if":["already-on-2.7.0","no-api-tokens"],"who_is_affected":"Any ProjectSend instance running a version from 2.0.0 before 2.7.0 that issues API tokens with manage_users and edit_users scopes is exposed. Instances without API tokens issued to restricted roles, or already on 2.7.0 or later, are not affected by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000597,"input_tokens":3352,"output_tokens":524,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112001':12A,15A '-2026':11A,14A '/api/v1/users':47B,87C '2.0.0':25B,64C '2.7.0':27B,66C 'account':9A 'allow':73C 'api':3A,31B,75C 'attack':50B,89C 'authent':44B,110C 'author':70C 'chang':33B,79C 'clear':40B,106C 'contain':67C 'credenti':84C 'cve':10A,13A 'edit':98C 'factor':43B,109C 'full':60B,119C 'holder':77C 'host':21B 'incorrect':69C 'interact':55B,114C 'let':28B 'limit':93C 'manag':95C 'new':103C 'owner':8A,36B,58B,82C,104C,117C 'packag':16B 'password':38B,105C 'patch':46B,86C 'permiss':62B,121C 'php':17B 'projectsend':1A,18B,22B,63C 'restrict':2A,30B,74C 'role':61B,120C 'self':20B 'self-host':19B 'set':101C 'sign':53B,112C 'take':6A 'token':4A,32B,35B,76C,81C,92C 'two':42B,108C 'two-factor':41B,107C 'user':48B,88C,96C,99C 'version':23B 'via':45B,85C 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Any ProjectSend instance running a version from 2.0.0 before 2.7.0 that issues API tokens with manage_users and edit_users scopes is exposed. Instances without API tokens issued to restricted roles, or already on 2.7.0 or later, are not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T12:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112001","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112001","severity":null,"published_at":"2026-10-18T12:17:12+00:00","modified_at":"2026-10-19T16:17:04+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}