CVE-2026-3977

projectsend AJAX Endpoints authorization

State: Published
Severity: 5.3 Medium
Published: Mar 12, 2026
Updated: Mar 12, 2026
Reserved: Mar 11, 2026

Description

A security vulnerability has been detected in projectsend up to r1945. The affected element is an unknown function of the component AJAX Endpoints. The manipulation leads to missing authorization. The attack can be initiated remotely. The identifier of the patch is 35dfd6f08f7d517709c77ee73e57367141107e6b. To fix this issue, it is recommended to deploy a patch.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C	VulDB

Weaknesses

CWE-862 Missing Authorization
CWE-863 Incorrect Authorization

Affected Products

Product	Versions
projectsendn/a	r1945Affected

References

VDB-350412 | projectsend AJAX Endpoints authorizationvdb-entry
VDB-350412 | CTI Indicators (IOB, IOC)signaturepermissions-required
https://github.com/projectsend/projectsend/issues/1525issue-tracking
https://github.com/projectsend/projectsend/issues/1525#issuecomment-3957109914issue-tracking
https://github.com/projectsend/projectsend/commit/35dfd6f08f7d517709c77ee73e57367141107e6bpatch
https://github.com/projectsend/projectsend/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.