PT-2026-24917 · Git · Projectsend

Lighthousekeeper1212 · Publicado 2026-03-12 · Atualizado 2026-03-12 · CVE-2026-3977

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions projectsend versions prior to r1946

Description A security issue has been identified in projectsend related to the AJAX Endpoints component. The problem involves a missing authorization check within an unknown function of this component, allowing for remote exploitation. The manipulation of the AJAX Endpoints component can lead to unauthorized access. The patch identifier for this issue is 35dfd6f08f7d517709c77ee73e57367141107e6b.

Recommendations Deploy the patch with identifier 35dfd6f08f7d517709c77ee73e57367141107e6b.

Correção

Missing Authorization

Incorrect Authorization

Enumeração de Fraquezas

CWE-862

CWE-863

Identificadores relacionados

CVE-2026-3977

Produtos afetados

Projectsend

Referências · 13

• https://github.com/projectsend/projectsend/issues/1525 · Nota
• https://github.com/projectsend/projectsend/issues/1525#issuecomment-3957109914 · Nota
• https://github.com/projectsend/projectsend/commit/35dfd6f08f7d517709c77ee73e57367141107e6b · Correção
• https://twitter.com/cyberbivash/status/2031962545892786228 · Publicação no Twitter
• https://t.me/CVEtracker/47223 · Publicação no Telegram
• https://vuldb.com/?ctiid.350412 · Nota
• https://vuldb.com/?id.350412 · Nota
• https://github.com/projectsend/projectsend · Nota
• https://twitter.com/CVEarity/status/2032076298932416772 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2031992339133317184 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-3977 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-3977 · Nota de Segurança
• https://t.me/cveNotify/155223 · Publicação no Telegram