Live › vulnerability › CVE-2026-116136
Go to dashboardProjectSend 2.0.0 through 2.7.1 has an incomplete authorization check in FileVersions::link(), so a staff user can link file versions to share files they should not. An attacker with a staff account can expose protected original files to clients outside their scope.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 12:40 UTC. All times on this page are UTC.
Teams running ProjectSend 2.0.0 through 2.7.1 that have staff users who can upload or manage file versions and assign clients. Installs without staff accounts, or on versions outside that range, are not in scope based on the sources.
No product ranges from the sources yet.
2.0.0 and 2.7.12.7.1; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an intermediate revision or assign out-of-scope clients, causing moveAssignmentsToRoot() to expose protected original files to unauthorized clients.
This page as .md · .json · in your agent: get_signal("CVE-2026-116136")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.