ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token… (CVE-2026-112001)

ProjectSend versions prior to 2.7.0 have an authorization bypass vulnerability (CVE-2026-112001) where API tokens limited to manage_users and edit_users can escalate privileges by modifying the token owner's credentials through the PATCH /api/v1/users/{user} endpoint. This allows attackers to reset the owner's password, clear two-factor authentication settings, and gain interactive access with full owner role permissions, effectively compromising the system's security controls.

An attacker possessing an API token with restricted permissions can escalate privileges to full owner level by changing the owner's credentials and disabling two-factor authentication. This leads to complete compromise of the affected ProjectSend instance, including unauthorized access and control over all owner-level functionalities.

No explicit patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict API token permissions carefully and monitor for suspicious API activity involving user credential changes.