CVE-2026-112001

7.2High

Published 18 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.2High

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-863

Impact

Authenticated attackers holding restricted API tokens can overwrite the token owner's password and reset their 2FA to take over their full account. This requires an existing API token scoped with manage_users and edit_users permissions.

Root cause

Improper authorization checks on the PATCH /api/v1/users/{user} endpoint allow tokens with limited edit permissions to modify the credentials and MFA settings of the token owner.

Affected systems

ProjectSend 2.0.0 before 2.7.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade ProjectSend to version 2.7.0 or higher. If patching must wait, revoke existing API tokens that have manage_users or edit_users permissions.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-112001