Description
ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create a durable local password, enroll their own second factor, and persistently take over the account.
Published: 2026-10-18
Score: 7.6 High
EPSS: n/a
KEV: No
Impact: Unverified Password Change leading to account takeover
Action: Apply Patch
AI Analysis

Impact

The PHP controller in ProjectSend allows a password to be set via a PUT request to /settings/password without requiring the current password when the user is authenticated through a session. This flaw enables an attacker who has obtained a valid session cookie to create a durable local password, enroll their own second factor, and persistently take over the account. The vulnerability is a classic CWE‑620 scenario that can lead to unauthorized access and credential compromise.

Affected Systems

ProjectSend versions 2.5.0 through 2.6.x are affected. The issue exists in the PasswordController and is fixed in version 2.7.0 and later.

Risk and Exploitability

The CVSS score of 7.6 indicates a high severity. No EPSS data is available, but the vulnerability can be exploited by anyone who can steal or hijack a session cookie, which is a relatively common attack vector. The vulnerability is not listed in the CISA KEV catalog, but the risk remains significant due to the potential for persistent account takeover.

Generated by OpenCVE AI on October 18, 2026 at 12:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade ProjectSend to version 2.7.0 or later to eliminate the flaw.
  • Revoke all active sessions and force users to re‑authenticate, reducing the usefulness of stolen session cookies.
  • Enable detailed logging and audit for password change requests to detect and respond to unauthorized activity.

Generated by OpenCVE AI on October 18, 2026 at 12:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
Description ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create a durable local password, enroll their own second factor, and persistently take over the account.
Title ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password
First Time appeared Projectsend
Projectsend projectsend
Weaknesses CWE-620
CPEs cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:*
Vendors & Products Projectsend
Projectsend projectsend
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N'}

cvssV4_0

{'score': 7.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Projectsend Projectsend
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-18T11:38:27.111Z

Reserved: 2026-10-18T01:23:19.660Z

Link: CVE-2026-112002

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-18T12:17:12.323

Modified: 2026-10-18T12:17:12.440

Link: CVE-2026-112002

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T12:30:14Z

Weaknesses
  • CWE-620

    Unverified Password Change