CVE-2026-112002GHSA-4r8h-mwfm-f5f4
ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password
ProjectSend ProjectSend
CVSS
7.6HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 20% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.7.0ProjectSendCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create a durable local password, enroll their own second factor, and persistently take over the account.
Text from CVE List
Affected versions 1
- ProjectSendaffected: 2.5.0 before 2.7.0CVE List
References 5
- github.com/projectsend/projectsend/commit/717852ff6a99391dbd816a2bb0bb3f40cad70f72Fixvia CVE List
- github.com/projectsend/projectsend/releases/tag/v2.7.0Fixvia CVE List
- github.com/projectsend/projectsend/security/advisories/GHSA-4r8h-mwfm-f5f4Advisoryvia CVE List
- vulncheck.com/advisories/projectsend-2.5.0-before-2.7.0-unverified-password-change-via-settings-passwordAdvisoryvia CVE List
- github.com/projectsend/projectsend/blob/v2.6.0/app/Http/Controllers/Settings/PasswordController.php#L54-L90Referencevia CVE List