# CVE-2026-112002: ProjectSend password change authentication bypass in social-provisioned accounts

Source: https://junglewise.ai/threats/cve-2026-112002-projectsend-2-5-0-before-2-7-0-contains-an-unverified-password  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-18. Updated: 2026-10-18  
License: CC BY 4.0 with a link back

CVE-2026-112002 · Severity: medium · CVSS 6.8 · Published 2026-10-18

ProjectSend is a file-sharing platform that allows users to authenticate via social media providers or local credentials. An attacker who obtains a session cookie from a social-provisioned account can set a local password without authentication, then enroll in two-factor authentication and take permanent control of that account, even if the legitimate owner signs out.

Technologies: [ProjectSend](https://junglewise.ai/threats/technologies/projectsend). Vendors: [ProjectSend](https://junglewise.ai/threats/vendors/projectsend).

## Quick answers

**Is CVE-2026-112002 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112002 being exploited in the wild.

**How severe is CVE-2026-112002?** Medium severity, with a CVSS score of 6.8, published 18 October 2026.

**Which products and versions are affected?** ProjectSend 2.5.0 before 2.7.0.

**Is there a fix for CVE-2026-112002?** Yes: fixed in 2.7.0. Until then: Restrict network access to the /settings/password endpoint to authenticated users only, or require email verification for password changes on social-provisioned accounts by implementing a separate password reset flow that sends a signed token to the user's registered email address. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112002 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-112002?** Check whether you run ProjectSend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.7.0

Restrict network access to the /settings/password endpoint to authenticated users only, or require email verification for password changes on social-provisioned accounts by implementing a separate password reset flow that sends a signed token to the user's registered email address.

## Technical details

The PasswordController::update() endpoint fails to validate the current password for accounts provisioned via social authentication (OAuth, SAML, etc.), accepting a PUT /settings/password request with only the new password. An attacker with a stolen session cookie can exploit this to create a durable local password, pivot to account takeover by enrolling their own second factor, and maintain persistence by removing the owner's authentication provider.

## Affected products

- ProjectSend ProjectSend 2.5.0 before 2.7.0

## Timeline

- 2026-10-18: disclosed
- 2026-10-05: patched

## References

- [https://github.com/projectsend/projectsend/blob/v2.6.0/app/Http/Controllers/Settings/PasswordController.php](https://github.com/projectsend/projectsend/blob/v2.6.0/app/Http/Controllers/Settings/PasswordController.php)
- [https://github.com/projectsend/projectsend/commit/717852ff6a99391dbd816a2bb0bb3f40cad70f72](https://github.com/projectsend/projectsend/commit/717852ff6a99391dbd816a2bb0bb3f40cad70f72)

## Related threats

- [ProjectSend incomplete authorization in FileVersions::link()](https://junglewise.ai/threats/cve-2026-116136-projectsend-2-0-0-through-2-7-1-contains-an-incomplete)
- [ProjectSend path validation flaw in OrphanFileScanner](https://junglewise.ai/threats/cve-2026-112003-projectsend-2-0-0-before-2-7-0-contains-a-path-validation-flaw)
- [ProjectSend authorization bypass via API token privilege escalation](https://junglewise.ai/threats/cve-2026-112001-projectsend-2-0-0-before-2-7-0-contains-an-incorrect)
- [ProjectSend stored XSS in files-edit.php](https://junglewise.ai/threats/cve-2021-47947-projectsend-stored-xss-in-files-edit-php)
- [ProjectSend CSRF in file upload endpoint](https://junglewise.ai/threats/cve-2026-5624-projectsend-csrf-in-file-upload-endpoint)