Live › vulnerability › CVE-2026-112002
Go to dashboardProjectSend 2.5.0 before 2.7.0 lets a session belonging to a Social-login account set a local password without supplying the current password. An attacker holding a stolen session cookie can set a durable password and enroll their own second factor to keep the account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Instances running ProjectSend 2.5.0 through 2.6.x that have accounts provisioned through Social login. The exposure requires a stolen session cookie, so instances without Social-provisioned accounts are less exposed. Teams that already run 2.7.0 or later can skip it.
No product ranges from the sources yet.
2.5.0 up to but not including 2.7.0.2.7.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create a durable local password, enroll their own second factor, and persistently take over the account.
This page as .md · .json · in your agent: get_signal("CVE-2026-112002")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.