7.2Yüksek
CVE-2026-112001ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities
Açıklama
ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.
Zayıflık türü (CWE):
CWE-863
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| ProjectSend | ProjectSend | 2.0.0 – < 2.7.0 |
Kaynaklar ve yamalar
- GitHub Security Advisory (GHSA-j5cp-r8pr-m5cr) vendor-advisory
- https://github.com/projectsend/projectsend/commit/db65731c3ad28ac7f0d541c60cb65eb100958514 patch
- ProjectSend v2.7.0 Release Notes release-notes
- https://github.com/projectsend/projectsend/blob/v2.6.0/app/Modules/Identity/StaffAccounts.php#L153-L162 technical-description
- VulnCheck Advisory: ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities third-party-advisory