Vendor
ProjectSend versions prior to 2.7.0 are vulnerable to an authorization flaw allowing API token holders with management permissions to elevate privileges by modifying the token owner's credentials.