ProjectSend
ProjectSend Security Releases - October 2026
projectsend-2026-10 Oct 1, 2026 Source: Vendor
ProjectSend security advisories for October 2026, compiled from CVE.org records.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.cve.org/CVERecord?id=CVE-2026-112001
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
3 lines
Showing 1–3 of 3
CVE-2026-112001
BR2026-0000-037255
ProjectSend
unclaimed
ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Att...
Credited as WHS4th Team TokenManiZo
CVE-2026-112002
BR2026-0000-037256
ProjectSend
unclaimed
ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the...
Credited as WHS4th Team TokenManiZo
CVE-2026-112003
BR2026-0000-037257
ProjectSend
unclaimed
ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat tracked files as orphans. Attackers can sub...
Credited as WHS4th Team TokenManiZo