CVE-2026-116136

ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an intermediate revision or assign out-of-scope clients, causing...

CVE-2026-116136 ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking

ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an intermediate revision or assign out-of-scope clients, causing...

CVE-2026-116136

ProjectSend versions 2.0.0 through 2.7.1 are vulnerable to an incorrect authorization flaw within the FileVersions::link() function. This vulnerability allows staff users to share files without proper authorization by linking file versions. Specifically, an attacker can link their file onto an in...

CVE-2026-116136 ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking

ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an intermediate revision or assign out-of-scope clients, causing...

CVE-2026-116136 ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking

ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an intermediate revision or assign out-of-scope clients, causing...

EUVD-2026-109388

ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an intermediate revision or assign out-of-scope clients, causing...

PT-2026-122977

ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an intermediate revision or assign out-of-scope clients, causing...

ProjectSend authorization issue vulnerability

Versions 2.0.0 through 2.7.1 of ProjectSend contain an authorization issue vulnerability. This vulnerability stems from incomplete authorization checks in FileVersions::link. Staff users can share files by linking to unauthorized file versions. Attackers can also link files to intermediate revisi...