CVE-2026-3977: ProjectSend Auth Bypass Vulnerability

CVE-2026-3977 Overview

A missing authorization vulnerability has been identified in ProjectSend versions up to r1945. The vulnerability affects an unknown function within the AJAX Endpoints component, allowing attackers to bypass authorization controls. This weakness (CWE-862: Missing Authorization) enables remote attackers to perform unauthorized actions through the affected endpoints without proper permission validation.

Critical Impact
Remote attackers can exploit missing authorization checks in ProjectSend AJAX endpoints to access or manipulate resources without proper authentication, potentially leading to unauthorized data access or system modifications.

Affected Products

ProjectSend versions up to r1945

Discovery Timeline

March 12, 2026 - CVE-2026-3977 published to NVD
March 12, 2026 - Last updated in NVD database

Technical Details for CVE-2026-3977

Vulnerability Analysis

This vulnerability stems from improper authorization enforcement within ProjectSend's AJAX endpoint handlers. When processing requests to AJAX endpoints, the application fails to verify whether the requesting user has appropriate permissions to perform the requested action. This missing authorization check allows authenticated users with low privileges—or potentially unauthenticated users—to access functionality that should be restricted.

The vulnerability is classified under CWE-862 (Missing Authorization), which describes scenarios where software does not perform an authorization check when an actor attempts to access a resource or perform an action. In the context of ProjectSend, this means the AJAX endpoints process requests without validating the caller's authorization level.

Root Cause

The root cause is the absence of proper authorization checks within the AJAX endpoint handlers. The affected code path processes incoming requests and executes the requested functionality without first verifying that the user has the necessary permissions. This architectural oversight allows unauthorized access to protected resources and operations.

Attack Vector

The vulnerability can be exploited remotely over a network connection. An attacker can craft HTTP requests to the vulnerable AJAX endpoints to perform unauthorized actions. Since the authorization checks are missing, the application processes these requests as if they came from an authorized user. The attack requires low privileges and no user interaction, making it relatively straightforward to exploit.

The exploitation mechanism involves sending direct HTTP requests to the AJAX endpoints. Without proper authorization verification, the server accepts and processes these requests, potentially allowing attackers to:

Access sensitive file information
Modify system configurations
Perform administrative actions without appropriate privileges

For technical details on the vulnerability, refer to GitHub Issue #1525.

Detection Methods for CVE-2026-3977

Indicators of Compromise

Unusual volume of requests to AJAX endpoints from unauthorized or low-privilege user sessions
HTTP requests to administrative AJAX functions from non-administrative accounts
Unexpected data modifications or access patterns in ProjectSend logs
Access logs showing direct API calls bypassing normal application workflow

Detection Strategies

Monitor web server access logs for anomalous request patterns to AJAX endpoints
Implement web application firewall (WAF) rules to detect and block unauthorized access attempts
Review audit logs for actions performed by users outside their permission scope
Deploy intrusion detection signatures targeting known exploitation patterns for missing authorization vulnerabilities

Monitoring Recommendations

Enable comprehensive logging for all AJAX endpoint access
Configure alerts for failed authorization attempts or unusual access patterns
Implement session monitoring to detect privilege escalation attempts
Regularly review access control lists and user permission assignments

How to Mitigate CVE-2026-3977

Immediate Actions Required

Update ProjectSend to a version containing the security patch (commit 35dfd6f08f7d517709c77ee73e57367141107e6b or later)
Review user access logs for signs of exploitation
Audit current user permissions and remove unnecessary privileges
Consider restricting access to the ProjectSend application until patching is complete

Patch Information

A patch has been released to address this vulnerability. The fix is available in GitHub Commit 35dfd6f08f7. The patch implements proper authorization checks in the affected AJAX endpoints to ensure users can only perform actions they are authorized to execute. Administrators should update their ProjectSend installations by pulling the latest code from the ProjectSend GitHub repository.

Workarounds

Implement network-level access controls to restrict access to the ProjectSend application to trusted IP addresses only
Deploy a web application firewall (WAF) with rules to validate authorization headers on AJAX requests
Disable or restrict access to non-essential AJAX endpoints until the patch can be applied
Implement additional authentication layers such as VPN access requirements for the application

bash

# Example: Restrict access to ProjectSend using Apache .htaccess
<Location "/ajax/">
    Require ip 10.0.0.0/8 192.168.0.0/16
    # Only allow access from internal network ranges
</Location>