ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization flaw that allows an attacker who holds an API token with manage_users and edit_users abilities to change the credentials of any user via the PATCH /api/v1/users/{user} endpoint. The attacker can set a new password, clear two‑factor authentication, and later sign in interactively with the full role permissions of the account owner, effectively taking full control of the account and compromising all data associated with it.

ProjectSend, any release prior to version 2.7.0, as identified by the vendor label ProjectSend:ProjectSend.

The CVSS score of 8.6 indicates high severity, and while no EPSS data is available, the vulnerability is not listed in the CISA KEV catalog. The flaw requires possession of a valid API token with specific scopes over HTTPS; once such a token is obtained, an attacker can trivially modify user credentials, disable two‑factor authentication, and effectively takeover the target account. No public exploits have yet been reported, but the potential for rapid credential compromise makes this a significant privilege‑escalation risk.