ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of… (CVE-2026-112002)

The vulnerability in ProjectSend 2.5.0 before 2.7.0 resides in the PasswordController::update() method, which fails to verify the current password when changing the password for social-provisioned accounts. This allows an attacker who has obtained a valid session cookie to send a PUT request to the /settings/password endpoint to create a local password without knowledge of the original password. Consequently, the attacker can enroll their own second factor authentication and maintain persistent control over the compromised account.

Successful exploitation results in high confidentiality and integrity impact, as attackers can take over user accounts persistently by setting local passwords and enrolling second factors. Availability impact is not affected. The vulnerability requires a stolen session cookie and has a high attack complexity and low privileges required, with no user interaction needed.

No explicit patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to session cookies and monitor for suspicious activity involving password changes on social-provisioned accounts.