A remote attacker can manipulate an unknown function within ProjectSend’s AJAX Endpoints to bypass authorization checks. By exploiting this missing authorization, an attacker can gain unauthorized access to protected resources, potentially compromising confidentiality and integrity of data. The vulnerability is reflected by CWE-862 and CWE-863 – missing authorization and missing permission checks.

ProjectSend applications up to revision r1945 are affected. Any deployment running a version of ProjectSend older than the patch containing commit 35dfd6f08f7d517709c77ee73e57367141107e6b is vulnerable.

The vulnerability carries a CVSS score of 5.3 and an EPSS score below 1%, indicating low exploitation probability. It is not listed in the CISA KEV catalog. The attack vector is remote, relying on an unauthenticated request to the vulnerable AJAX endpoint. Given the moderate severity and low exploitation likelihood, the risk is significant enough to warrant patching, but discovery of the vulnerability may be opportunistic.