CVE-2026-116136 in ProjectSend
Summary
by MITRE • 10/25/2026
ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an intermediate revision or assign out-of-scope clients, causing moveAssignmentsToRoot() to expose protected original files to unauthorized clients.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified in ProjectSend versions 2.0.0 through 2.7.1 represents a critical failure in access control mechanisms within the application's file management subsystem. Specifically, this flaw resides in the FileVersions::link() method, which is designed to manage relationships between different iterations of uploaded files. The core issue stems from an incomplete authorization check that fails to validate whether the staff user initiating the link operation possesses the necessary permissions for the target file version or the associated client context. This oversight allows authenticated staff members with lower-level privileges to manipulate internal data structures in ways intended only for administrators or users with elevated rights, thereby bypassing standard security boundaries designed to protect sensitive organizational assets.
From a technical perspective, the exploitation of this vulnerability involves linking an attacker-controlled file onto an intermediate revision of another file rather than directly manipulating the original upload. This specific maneuver triggers a subsequent function called moveAssignmentsToRoot(), which is responsible for reassigning client access permissions based on the current state of file versions and their associated metadata. Because the initial link operation did not enforce strict authorization checks, the system incorrectly assumes that all linked files inherit appropriate permission sets. Consequently, when moveAssignmentsToRoot() executes, it exposes protected original files to clients who were never intended to have access. This effectively creates a privilege escalation path where unauthorized users can view or download confidential documents by exploiting the logical flow of file versioning and assignment logic.
The operational impact of this vulnerability is severe, as it directly compromises the confidentiality integrity of shared data within the ProjectSend environment. Staff users who should be restricted to specific project scopes are able to bypass these restrictions, leading to potential data leakage of sensitive corporate information, intellectual property, or personal identifiable information depending on the content stored in the system. The ability to assign out-of-scope clients further exacerbates the risk by expanding the attack surface beyond internal staff to external entities who may have malicious intent. This type of access control failure aligns with CWE-269, which describes Improper Privilege Assignment, and is also indicative of CWE-862, Missing Authorization, as the system fails to enforce proper policy decisions regarding resource access.
In terms of threat modeling, this vulnerability can be mapped to MITRE ATT&CK techniques related to lateral movement or data exfiltration within a compromised account context. An attacker leveraging this flaw would likely engage in unauthorized access to restricted resources, potentially leading to further exploitation if the exposed files contain credentials or configuration details that facilitate deeper system compromise. The lack of granular permission checks during file version linking highlights a broader architectural weakness where business logic dependencies are not adequately secured against manipulation by lower-privileged actors.
To mitigate this vulnerability, immediate action is required to update ProjectSend to a patched version released after 2.7.1, as the developer has addressed these authorization flaws in subsequent releases. For organizations unable to patch immediately due to operational constraints, implementing strict input validation on all file linking operations and ensuring that moveAssignmentsToRoot() performs independent verification of user permissions against the target resource is essential. Additionally, auditing existing staff accounts for excessive privileges can reduce the blast radius if an attacker gains access to a lower-privileged account. Regular security assessments focusing on role-based access control logic are recommended to identify similar gaps in other modules where file operations intersect with client assignment workflows.