CVE-2026-112001

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-112001
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112001.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-112001
Aliases
  • GHSA-j5cp-r8pr-m5cr
Published
2026-10-18T11:38:26Z
Modified
2026-10-19T02:45:41Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities
Details

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112001.json"
}
References

Affected packages

Git / github.com/projectsend/projectsend

Affected ranges

Type
GIT
Repo
https://github.com/projectsend/projectsend
Events
Introduced
d69c1eda772036870dade87d2c204d6a17a910fe
Fixed
f22a346469505bc5542e236b59fdcd2a3e1d3ec5
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "2.0.0"
        },
        {
            "fixed":  "2.7.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112001.json"