PT-2026-24917 · Git · Projectsend

Lighthousekeeper1212 · Published 2026-03-12 · Updated 2026-03-12 · CVE-2026-3977

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions projectsend versions prior to r1946

Description A security issue has been identified in projectsend related to the AJAX Endpoints component. The problem involves a missing authorization check within an unknown function of this component, allowing for remote exploitation. The manipulation of the AJAX Endpoints component can lead to unauthorized access. The patch identifier for this issue is 35dfd6f08f7d517709c77ee73e57367141107e6b.

Recommendations Deploy the patch with identifier 35dfd6f08f7d517709c77ee73e57367141107e6b.

Fix

Missing Authorization

Incorrect Authorization

Weakness Enumeration

CWE-862

CWE-863

Related Identifiers

CVE-2026-3977

Affected Products

Projectsend

References · 13

• https://github.com/projectsend/projectsend/commit/35dfd6f08f7d517709c77ee73e57367141107e6b · Patch
• https://osv.dev/vulnerability/CVE-2026-3977 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3977 · Security Note
• https://github.com/projectsend/projectsend/issues/1525 · Note
• https://github.com/projectsend/projectsend/issues/1525#issuecomment-3957109914 · Note
• https://twitter.com/cyberbivash/status/2031962545892786228 · Twitter Post
• https://t.me/CVEtracker/47223 · Telegram Post
• https://vuldb.com/?ctiid.350412 · Note
• https://vuldb.com/?id.350412 · Note
• https://github.com/projectsend/projectsend · Note
• https://twitter.com/CVEarity/status/2032076298932416772 · Twitter Post
• https://twitter.com/CVEnew/status/2031992339133317184 · Twitter Post
• https://t.me/cveNotify/155223 · Telegram Post