CVE-2026-3977: ProjectSend Auth Bypass Vulnerability

CVE-2026-3977 Overview

A missing authorization vulnerability has been identified in ProjectSend versions up to r1945. The vulnerability affects an unknown function within the AJAX Endpoints component, allowing attackers to bypass authorization controls. This weakness (CWE-862: Missing Authorization) enables remote attackers to perform unauthorized actions through the affected endpoints without proper permission validation.

Critical Impact

Remote attackers can exploit missing authorization checks in ProjectSend AJAX endpoints to access or manipulate resources without proper authentication, potentially leading to unauthorized data access or system modifications.

Affected Products

• ProjectSend versions up to r1945

Discovery Timeline

• March 12, 2026 - CVE-2026-3977 published to NVD
• March 12, 2026 - Last updated in NVD database

Technical Details for CVE-2026-3977

Vulnerability Analysis

This vulnerability stems from improper authorization enforcement within ProjectSend's AJAX endpoint handlers. When processing requests to AJAX endpoints, the application fails to verify whether the requesting user has appropriate permissions to perform the requested action. This missing authorization check allows authenticated users with low privileges—or potentially unauthenticated users—to access functionality that should be restricted.

The vulnerability is classified under CWE-862 (Missing Authorization), which describes scenarios where software does not perform an authorization check when an actor attempts to access a resource or perform an action. In the context of ProjectSend, this means the AJAX endpoints process requests without validating the caller's authorization level.

Root Cause

The root cause is the absence of proper authorization checks within the AJAX endpoint handlers. The affected code path processes incoming requests and executes the requested functionality without first verifying that the user has the necessary permissions. This architectural oversight allows unauthorized access to protected resources and operations.

Attack Vector

The vulnerability can be exploited remotely over a network connection. An attacker can craft HTTP requests to the vulnerable AJAX endpoints to perform unauthorized actions. Since the authorization checks are missing, the application processes these requests as if they came from an authorized user. The attack requires low privileges and no user interaction, making it relatively straightforward to exploit.

The exploitation mechanism involves sending direct HTTP requests to the AJAX endpoints. Without proper authorization verification, the server accepts and processes these requests, potentially allowing attackers to:

• Access sensitive file information
• Modify system configurations
• Perform administrative actions without appropriate privileges

For technical details on the vulnerability, refer to GitHub Issue #1525.

Detection Methods for CVE-2026-3977

Indicators of Compromise

• Unusual volume of requests to AJAX endpoints from unauthorized or low-privilege user sessions
• HTTP requests to administrative AJAX functions from non-administrative accounts
• Unexpected data modifications or access patterns in ProjectSend logs
• Access logs showing direct API calls bypassing normal application workflow

Detection Strategies

• Monitor web server access logs for anomalous request patterns to AJAX endpoints
• Implement web application firewall (WAF) rules to detect and block unauthorized access attempts
• Review audit logs for actions performed by users outside their permission scope
• Deploy intrusion detection signatures targeting known exploitation patterns for missing authorization vulnerabilities

Monitoring Recommendations

• Enable comprehensive logging for all AJAX endpoint access
• Configure alerts for failed authorization attempts or unusual access patterns
• Implement session monitoring to detect privilege escalation attempts
• Regularly review access control lists and user permission assignments

How to Mitigate CVE-2026-3977

Immediate Actions Required

• Update ProjectSend to a version containing the security patch (commit 35dfd6f08f7d517709c77ee73e57367141107e6b or later)
• Review user access logs for signs of exploitation
• Audit current user permissions and remove unnecessary privileges
• Consider restricting access to the ProjectSend application until patching is complete

Patch Information

A patch has been released to address this vulnerability. The fix is available in GitHub Commit 35dfd6f08f7. The patch implements proper authorization checks in the affected AJAX endpoints to ensure users can only perform actions they are authorized to execute. Administrators should update their ProjectSend installations by pulling the latest code from the ProjectSend GitHub repository.

Workarounds

• Implement network-level access controls to restrict access to the ProjectSend application to trusted IP addresses only
• Deploy a web application firewall (WAF) with rules to validate authorization headers on AJAX requests
• Disable or restrict access to non-essential AJAX endpoints until the patch can be applied
• Implement additional authentication layers such as VPN access requirements for the application

# Example: Restrict access to ProjectSend using Apache .htaccess
<Location "/ajax/">
    Require ip 10.0.0.0/8 192.168.0.0/16
    # Only allow access from internal network ranges
</Location>