Is CVE-2026-112002 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112002 being exploited in the wild.

How severe is CVE-2026-112002?

Medium severity, with a CVSS score of 6.8, published 18 October 2026.

Which products and versions are affected?

ProjectSend 2.5.0 before 2.7.0.

How is CVE-2026-112002 attacked?

It is attacked over the network.

Am I affected by CVE-2026-112002?

Check whether you run ProjectSend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112002: ProjectSend password change authentication bypass in social-provisioned accounts

CVE-2026-112002 · Severity: medium · CVSS 6.8 · Published 2026-10-18

ProjectSend is a file-sharing platform that allows users to authenticate via social media providers or local credentials. An attacker who obtains a session cookie from a social-provisioned account can set a local password without authentication, then enroll in two-factor authentication and take permanent control of that account, even if the legitimate owner signs out.

Technologies: ProjectSend. Vendors: ProjectSend.

Quick answers

Is CVE-2026-112002 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112002 being exploited in the wild.
How severe is CVE-2026-112002?: Medium severity, with a CVSS score of 6.8, published 18 October 2026.
Which products and versions are affected?: ProjectSend 2.5.0 before 2.7.0.
Is there a fix for CVE-2026-112002?: Yes: fixed in 2.7.0. Until then: Restrict network access to the /settings/password endpoint to authenticated users only, or require email verification for password changes on social-provisioned accounts by implementing a separate password reset flow that sends a signed token to the user's registered email address. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112002 attacked?: It is attacked over the network.
Am I affected by CVE-2026-112002?: Check whether you run ProjectSend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.7.0

Restrict network access to the /settings/password endpoint to authenticated users only, or require email verification for password changes on social-provisioned accounts by implementing a separate password reset flow that sends a signed token to the user's registered email address.

Technical details

The PasswordController::update() endpoint fails to validate the current password for accounts provisioned via social authentication (OAuth, SAML, etc.), accepting a PUT /settings/password request with only the new password. An attacker with a stolen session cookie can exploit this to create a durable local password, pivot to account takeover by enrolling their own second factor, and maintain persistence by removing the owner's authentication provider.

Affected products

ProjectSend ProjectSend 2.5.0 before 2.7.0

Timeline

2026-10-18: disclosed
2026-10-05: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.