ProjectSend API flaw allows token holders to reset owner credentials

A vulnerability in ProjectSend allows holders of restricted API tokens to change the credentials of the token owner. The flaw, tracked as CVE-2026-112001, affects all versions before 2.7.0 and is rated high severity by the NVD.

What happened

The NVD record for CVE-2026-112001 describes an incorrect authorisation weakness in ProjectSend. The vulnerability exists in versions prior to 2.7.0 and is categorised under CWE-863. It allows an attacker who holds a restricted API token to perform actions that should not be permitted by that token's scope. Specifically, the flaw involves the PATCH /api/v1/users/{user} endpoint.

Why it matters

An attacker needs a token limited to the manage_users and edit_users permissions to exploit this issue. Using such a token, the attacker can set a new password for the account that owns the token. The attacker can also clear the two-factor authentication settings for that account. This allows the attacker to sign in interactively using the token owner's full role permissions.

What happens next

• Identify all installations of ProjectSend running versions before 2.7.0.
• Audit API tokens issued within the platform, focusing on those with user management capabilities.
• Review access logs for unusual activity on the user management API endpoints.
• Plan an upgrade to version 2.7.0 or later to remediate the authorisation flaw.

Patch priority

Teams should prioritise updating exposed instances of ProjectSend immediately. Organisations must check whether their deployment allows external access to the API. If exposure is public, the risk is significantly higher. Apply the update to production systems after testing in a staging environment. Ensure backups are current before proceeding. If a direct upgrade is not possible, restrict network access to the API endpoints to trusted internal networks only. This limits the attack surface while a permanent fix is prepared.

What to do and how to stay safe: ProjectSend

• Verify the version of ProjectSend running on your servers to determine if it is affected.
• Rotate or revoke API tokens that have manage_users or edit_users permissions immediately.
• Enable multi-factor authentication for all administrative accounts if it is not already enforced.
• Monitor authentication logs for successful logins from unexpected locations or accounts.

Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality

General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of ProjectSend are affected by CVE-2026-112001?

All versions of ProjectSend prior to 2.7.0 are affected by this vulnerability.

What permissions does an attacker need to exploit this flaw?

The attacker requires an API token with manage_users and edit_users permissions.

Can an attacker access the system without a valid token?

No, the source material states the attacker must hold a restricted API token to exploit the flaw.