PT-2026-35443 · Projeqtor · Projeqtor

Noé Susset + 1 · Published 2026-04-27 · Updated 2026-04-27 · CVE-2026-41464

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ProjeQtor versions 7.0 through 12.4.3

Description Authenticated users with guest-level privileges can retrieve sensitive data belonging to other users, such as password hashes and API keys. This occurs due to missing authorization in the 'objectDetail.php' endpoint, allowing attackers to bypass access controls without ownership or role-based validation to extract administrator credentials and perform privilege escalation.

Recommendations Update to version 12.4.4. As a temporary workaround, restrict access to the 'objectDetail.php' endpoint to minimize the risk of exploitation.

Exploit

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-41464

Affected Products

Projeqtor

References · 8

• 🔥 https://gryfman.fr/cves/CVE-2026-41464 · Exploit
• 🔥 https://damiri.fr/en/cves/CVE-2026-41464 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41464 · Security Note
• https://vulncheck.com/advisories/projeqtor-missing-authorization-via-objectdetail-php · Note
• https://twitter.com/CVEnew/status/2048852149539328313 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2048822196965879817 · Twitter Post
• https://projeqtor.com · Note
• https://t.me/CVEtracker/51958 · Telegram Post