CVE-2026-112001 ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/user. Attackers with a token limited to manageusers and editusers can set a new owner password, clear two-facto...