Incorrect Authorization in ProjectSend API

ProjectSend versions 2.0.0 through 2.6.x contain an incorrect authorization vulnerability (CVE-2026-112001) within the application's API. This vulnerability allows an attacker who possesses a valid API token with 'manage_users' and 'edit_users' permissions to perform unauthorized administrative actions. Specifically, the attacker can interact with the PATCH /api/v1/users/{user} endpoint to modify the password of the token owner. Furthermore, this exploit allows for the disabling of two-factor authentication (2FA) for that account. By performing these actions, the attacker can bypass security controls to gain interactive login access to the system, effectively inheriting the account's full role permissions. This flaw represents a significant risk for environments relying on ProjectSend for file management, as it enables lateral movement and privilege escalation for users with otherwise limited API-only access.

Impact

Successful exploitation of this vulnerability allows unauthorized users to escalate their privileges to match the owner of the API token. In scenarios where the token belongs to an administrator, this leads to full system compromise. The vulnerability affects all ProjectSend instances running versions prior to 2.7.0. If compromised, an attacker can exfiltrate sensitive files, modify system configurations, or create additional persistent accounts.

Recommendation

• Upgrade all instances of ProjectSend to version 2.7.0 or later to remediate CVE-2026-112001.
• Audit existing API tokens to identify and revoke tokens with 'manage_users' or 'edit_users' permissions that are not strictly required for current integrations.
• Review web server access logs for anomalous PATCH requests targeting /api/v1/users/ endpoints.