CVE-2026-3977

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-3977

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3977.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-3977

Published

2026-03-12T03:02:08.383Z

Modified

2026-08-04T11:49:47.490043122Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X CVSS Calculator

Summary

projectsend AJAX Endpoints authorization

Details

A security vulnerability has been detected in projectsend up to r1945. The affected element is an unknown function of the component AJAX Endpoints. The manipulation leads to missing authorization. The attack can be initiated remotely. The identifier of the patch is 35dfd6f08f7d517709c77ee73e57367141107e6b. To fix this issue, it is recommended to deploy a patch.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3977.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-862",
        "CWE-863"
    ]
}

References

Affected packages

Git / github.com/projectsend/projectsend

Affected ranges

Type

GIT

Repo

https://github.com/projectsend/projectsend

Events

Introduced

944dd2924631a526c052c30181032e3066245982

Last affected

944dd2924631a526c052c30181032e3066245982

Database specific

{
    "extracted_events": [
        {
            "introduced": "r1945"
        },
        {
            "last_affected": "r1945"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

Other

r1945

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3977.json"