# CVE-2026-112001: ProjectSend authorization bypass via API token privilege escalation

Source: https://junglewise.ai/threats/cve-2026-112001-projectsend-2-0-0-before-2-7-0-contains-an-incorrect  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-18. Updated: 2026-10-18  
License: CC BY 4.0 with a link back

CVE-2026-112001 · Severity: high · CVSS 7.2 · Published 2026-10-18

ProjectSend is a secure file-sharing platform used to distribute documents to clients and staff. A vulnerability in versions 2.0.0 through 2.6.0 allows attackers with limited API tokens to escalate privileges by modifying the account owner's credentials, resetting two-factor authentication, and logging in with full administrative access. An attacker could take complete control of the system.

Technologies: [ProjectSend](https://junglewise.ai/threats/technologies/projectsend). Vendors: [ProjectSend](https://junglewise.ai/threats/vendors/projectsend).

## Quick answers

**Is CVE-2026-112001 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112001 being exploited in the wild.

**How severe is CVE-2026-112001?** High severity, with a CVSS score of 7.2, published 18 October 2026.

**Which products and versions are affected?** ProjectSend 2.0.0 before 2.7.0.

**Is there a fix for CVE-2026-112001?** Yes: fixed in ProjectSend 2.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112001 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-112001?** Check whether you run ProjectSend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in ProjectSend 2.7.0

## Technical details

The vulnerability is an incorrect authorization flaw in the PATCH /api/v1/users/{user} endpoint that fails to prevent restricted API tokens (limited to manage_users and edit_users permissions) from modifying the owner's own password, email, and two-factor authentication settings. An authenticated attacker with a restricted token can escalate to full owner privileges and access all account data. The fix restricts credential changes via API to prevent token holders from modifying their own sensitive attributes.

## Affected products

- ProjectSend ProjectSend 2.0.0 before 2.7.0

## Timeline

- 2026-10-18: disclosed
- 2026-10-03: patched

## References

- [https://github.com/projectsend/projectsend/blob/v2.6.0/app/Modules/Identity/StaffAccounts.php](https://github.com/projectsend/projectsend/blob/v2.6.0/app/Modules/Identity/StaffAccounts.php)
- [https://github.com/projectsend/projectsend/commit/db65731c3ad28ac7f0d541c60cb65eb100958514](https://github.com/projectsend/projectsend/commit/db65731c3ad28ac7f0d541c60cb65eb100958514)

## Related threats

- [ProjectSend incomplete authorization in FileVersions::link()](https://junglewise.ai/threats/cve-2026-116136-projectsend-2-0-0-through-2-7-1-contains-an-incomplete)
- [ProjectSend path validation flaw in OrphanFileScanner](https://junglewise.ai/threats/cve-2026-112003-projectsend-2-0-0-before-2-7-0-contains-a-path-validation-flaw)
- [ProjectSend password change authentication bypass in social-provisioned accounts](https://junglewise.ai/threats/cve-2026-112002-projectsend-2-5-0-before-2-7-0-contains-an-unverified-password)
- [ProjectSend stored XSS in files-edit.php](https://junglewise.ai/threats/cve-2021-47947-projectsend-stored-xss-in-files-edit-php)
- [ProjectSend CSRF in file upload endpoint](https://junglewise.ai/threats/cve-2026-5624-projectsend-csrf-in-file-upload-endpoint)