A flaw in ProjectSend’s authentication module, specifically in includes/Classes/Auth.php, allows an attacker to manipulate the ldap_email argument and trigger an observable response discrepancy. This response difference can be used to infer the existence of LDAP accounts or confirm authentication states, effectively enabling user enumeration. The vulnerability corresponds to CWE‑203 (Information Exposure Through Logs) and CWE‑204 (Information Exposure Through Non‑Error Messages).

The affected product is ProjectSend, with all releases up to revision 1945 identified as vulnerable. No specific sub‑versions beyond r1945 are mentioned; later releases are assumed unaffected.

The CVSS score of 6.3 indicates moderate severity, while the EPSS score of less than 1% reflects a low overall exploitation probability. The exploit has been published and is considered difficult, suggesting that an attacker would need remote access to the vulnerable endpoint and a high level of technical skill to succeed. The vulnerability is not listed in the CISA KEV catalog, but the existence of a published exploit demonstrates that exploitation is possible in the right circumstances.