{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/projectsend--2.7.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-112001"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ProjectSend (\u003c 2.7.0)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","web-application","vulnerability"],"_cs_type":"advisory","_cs_vendors":["ProjectSend"],"content_html":"\u003cp\u003eProjectSend versions 2.0.0 through 2.6.x contain an incorrect authorization vulnerability (CVE-2026-112001) within the application's API. This vulnerability allows an attacker who possesses a valid API token with 'manage_users' and 'edit_users' permissions to perform unauthorized administrative actions. Specifically, the attacker can interact with the PATCH /api/v1/users/{user} endpoint to modify the password of the token owner. Furthermore, this exploit allows for the disabling of two-factor authentication (2FA) for that account. By performing these actions, the attacker can bypass security controls to gain interactive login access to the system, effectively inheriting the account's full role permissions. This flaw represents a significant risk for environments relying on ProjectSend for file management, as it enables lateral movement and privilege escalation for users with otherwise limited API-only access.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows unauthorized users to escalate their privileges to match the owner of the API token. In scenarios where the token belongs to an administrator, this leads to full system compromise. The vulnerability affects all ProjectSend instances running versions prior to 2.7.0. If compromised, an attacker can exfiltrate sensitive files, modify system configurations, or create additional persistent accounts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of ProjectSend to version 2.7.0 or later to remediate CVE-2026-112001.\u003c/li\u003e\n\u003cli\u003eAudit existing API tokens to identify and revoke tokens with 'manage_users' or 'edit_users' permissions that are not strictly required for current integrations.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous PATCH requests targeting /api/v1/users/ endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-18T12:21:26Z","date_published":"2026-10-18T12:21:26Z","id":"https://feed.craftedsignal.io/briefs/2026-10-projectsend-auth-bypass/","summary":"ProjectSend versions prior to 2.7.0 are vulnerable to an authorization flaw allowing API token holders with management permissions to elevate privileges by modifying the token owner's credentials.","title":"Incorrect Authorization in ProjectSend API","url":"https://feed.craftedsignal.io/briefs/2026-10-projectsend-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - ProjectSend (\u003c 2.7.0)","version":"https://jsonfeed.org/version/1.1"}