VulnSocial

CVE-2026-112001

LOWCVSS 8.6 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-18: 110-18
Referenced assets1 URL
By indicator
Full discourse1 post
  • ADK Cyber@ADKCyber

    ProjectSend versions before 2.7.0 contain a high-severity authorization flaw (CVSS 8.6). Update to 2.7.0+ if this tool is in use. https://nvd.nist.gov/vuln/detail/CVE-2026-112001 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/KO9gMpPIZY

    0000029
    99 followersView on X

Explore more

Back to dashboard