Technical impact
ProjectSend releases 2.0.0 through 2.7.1 contain an incomplete authorization flaw in the file version linking function. The flaw lets staff users link a file to an intermediate revision or assign it to out‑of‑scope clients. When the application later moves these assignments to the root level, protected original files are exposed to clients that were not authorized to view them. The weakness falls under unauthorized access, documented as a CWE‑863 authorization bypass.
Affected Systems
The affected product is ProjectSend, a file‑sharing application, version 2.0.0 through 2.7.1. All installations running any of these releases are vulnerable, regardless of additional configuration choices.
Risk and Exploitability
The CVSS score of 6.0 indicates medium severity. No publicly known exploits are listed and the vulnerability is not in the CISA KEV catalog, implying a lower likelihood of exploitation. However, the attack requires that the attacker be an authenticated staff member, so it represents an insider or compromised account threat. An attacker can surreptitiously share protected files with clients outside their authorized scope, potentially exposing confidential data.
