ProjectSend: Incorrect authorization via API token abilities

Summary

ProjectSend 2.0.0 before 2.7.0 lets a restricted API token holder change the credentials of the token owner. A token limited to manage_users and edit_users can set a new password for the owner, clear two-factor authentication and sign in interactively with the owner's full role permissions. The attack requires a valid staff API token with these abilities, so the main risk comes from malicious or careless staff members or from stolen tokens.

Affected

• ProjectSend 2.0.0 to before 2.7.0

Fixed in

• Fixed in ProjectSend 2.7.0 (released 6 October 2026)
• The vendor's security notes state that an API token can no longer change its own owner's password, email address or two-factor setting

Workaround

• No complete workaround; upgrade to 2.7.0 or later
• Until the upgrade, revoke API tokens with manage_users or edit_users that are not needed
• Set expiry dates on all API tokens
• Check the activity log for unexpected token activity
• Two-factor authentication does not prevent this attack path

Exploitation

• CISA SSVC: exploitation status 'poc', automatable 'no', technical impact 'total'
• Not listed as known exploited (KEV)
• No public proof of concept found; treat as unknown
• CVSS 4.0 base score 8.6 (NVD status: Deferred)

Our recommendation

• Identify all ProjectSend instances and confirm their version; versions before 2.7.0 are affected
• Upgrade to 2.7.0 or later and review the 2.7.1 release notes
• Audit API tokens now and revoke every token with manage_users or edit_users that is not required
• Restrict admin and API access to trusted networks where possible
• Review staff passwords, 2FA settings and the activity log for unexpected changes to owner accounts since 6 October 2026

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Linked page: StaffAccounts.php at v2.6.0 (vulnerable code) github.com
• Fix commit db65731c github.com
• ProjectSend 2.7.0 release github.com
• GitHub Security Advisory GHSA-j5cp-r8pr-m5cr github.com
• VulnCheck advisory www.vulncheck.com
• OSV CVE-2026-112001 osv.dev
• ProjectSend hardening guide www.projectsend.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:48.