API Token Privilege Escalation via Improper Authorization

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

ProjectSend 2.0.0 through 2.6.x contains a critical authorization bypass in its REST API that allows attackers with restricted API tokens to escalate privileges and compromise the platform owner's account. The vulnerability exists in the PATCH /api/v1/users/{user} endpoint, where insufficient permission checks permit token holders scoped only to manage_users and edit_users capabilities to modify the owner's password, disable multi-factor authentication, and gain full administrative access. This affects any ProjectSend deployment relying on API tokens for access control, particularly those integrating external systems or automation tools that use restricted service accounts.

Casky's 283 matching skills leverage Claude's extended reasoning to map this vulnerability across MITRE ATT&CK's TA0004 (Privilege Escalation) and TA0006 (Credential Access) techniques. Practitioners using Casky would identify attack patterns including: API endpoint abuse indicating Privilege Escalation via Exploitation (T1548), unauthorized credential modification showing Account Manipulation (T1098), and MFA bypass attempts pointing to Modify Authentication Process (T1556). The platform's Claude-powered analysis would flag suspicious API calls with token scope mismatches, unauthorized PATCH requests targeting user endpoints, and follow-on attempts at interactive authentication using modified owner credentials—enabling security teams to detect these privilege escalation chains before full account compromise occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-112001.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-112001

Casky has 283 skills that investigate the attack patterns behind CVE-2026-112001. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn