CVE-2026-112002 | ProjectSend up to 2.6.x /settings/password update improper authentication

October 18, 2026 Yanac

A vulnerability was found in ProjectSend up to 2.6.x and classified as critical. This affects the function PasswordController::update of the file /settings/password. Executing a manipulation can lead to improper authentication.

This vulnerability is handled as CVE-2026-112002. The attack can be executed remotely. There is not any exploit available.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More