{"id":"CVE-2026-116136","kind":"vulnerability","aliases":["CVE-2026-116136"],"related":[],"title":"ProjectSend: staff can share protected files through version linking","description":"ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an intermediate revision or assign out-of-scope clients, causing moveAssignmentsToRoot() to expose protected original files to unauthorized clients.","summary":"ProjectSend 2.0.0 through 2.7.1 has an incomplete authorization check in FileVersions::link(), so a staff user can link file versions to share files they should not. An attacker with a staff account can expose protected original files to clients outside their scope.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","projectsend","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed ProjectSend version in the application's config or footer, and see whether it falls between `2.0.0` and `2.7.1`\n- unknown for other checks, the sources do not say","fix":"- Upgrade ProjectSend to a release later than `2.7.1`; the sources do not name the fixed version\n- unknown for other actions, the sources do not say","status":"open","published_at":"2026-10-25T12:16:30+00:00","first_seen_at":"2026-10-25T12:40:44+00:00","triaged_at":"2026-10-25T12:41:31+00:00","updated_at":"2026-10-25T12:41:31+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T12:41:31Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ProjectSend to a release later than `2.7.1`; the sources do not name the fixed version\n- unknown for other actions, the sources do not say","reach":"network","title":"ProjectSend: staff can share protected files through version linking","impact":"medium","summary":"ProjectSend 2.0.0 through 2.7.1 has an incomplete authorization check in FileVersions::link(), so a staff user can link file versions to share files they should not. An attacker with a staff account can expose protected original files to clients outside their scope.","category":"package","nicknames":[],"who_cares":["projectsend","self-hosted","php"],"confidence":0.6,"needs_auth":"yes","worst_case":"Unauthorized clients read protected original files from other scopes","analyst_note":"Find the ProjectSend advisory or patched release tag and confirm the fixed version and any configuration requirements.","how_to_check":"- Check the installed ProjectSend version in the application's config or footer, and see whether it falls between `2.0.0` and `2.7.1`\n- unknown for other checks, the sources do not say","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running ProjectSend 2.0.0 through 2.7.1 that have staff users who can upload or manage file versions and assign clients. Installs without staff accounts, or on versions outside that range, are not in scope based on the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000596,"input_tokens":3352,"output_tokens":521,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116136':12A,15A '-2026':11A,14A '2.0.0':23B,65C '2.7.1':25B,67C 'account':53B 'allow':77C 'assign':99C 'attack':49B,89C 'author':29B,71C,84C 'caus':105C 'check':30B 'client':60B,104C,114C 'contain':68C 'cve':10A,13A 'expos':55B,108C 'file':6A,40B,44B,58B,82C,87C,93C,111C 'filevers':32B,74C 'host':21B 'incomplet':28B,70C 'intermedi':96C 'link':9A,33B,39B,75C,86C,91C 'moveassignmentstoroot':106C 'onto':94C 'origin':57B,110C 'out-of-scop':100C 'outsid':61B 'packag':16B 'php':17B 'projectsend':1A,18B,22B,64C 'protect':5A,56B,109C 'revis':97C 'scope':63B,103C 'self':20B 'self-host':19B 'share':4A,43B,81C 'staff':2A,36B,52B,78C 'unauthor':113C 'user':37B,79C 'version':8A,41B,88C 'vulner':72C 'without':83C","nicknames":[],"mitigations":[],"who_affected":"Teams running ProjectSend 2.0.0 through 2.7.1 that have staff users who can upload or manage file versions and assign clients. Installs without staff accounts, or on versions outside that range, are not in scope based on the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T12:16:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116136","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116136","severity":null,"published_at":"2026-10-25T12:16:30+00:00","modified_at":"2026-10-25T12:16:30+00:00","first_seen_at":"2026-10-25T12:40:44+00:00","fetched_at":"2026-10-25T12:40:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}