Medium severity · published Mar 12, 2026
CVE-2026-3977
projectsend AJAX Endpoints authorization
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
A security vulnerability has been detected in projectsend up to r1945. The affected element is an unknown function of the component AJAX Endpoints. The manipulation leads to missing authorization. The attack can be initiated remotely. The identifier of the patch is 35dfd6f08f7d517709c77ee73e57367141107e6b. To fix this issue, it is recommended to deploy a patch.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
projectsend · Projectsend
r1945 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3977
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3977
github.com
https://github.com/projectsend/projectsend/
github.com
https://github.com/projectsend/projectsend/commit/35dfd6f08f7d517709c77ee73e57367141107e6b
github.com
https://github.com/projectsend/projectsend/issues/1525
github.com
https://github.com/projectsend/projectsend/issues/1525#issuecomment-3957109914
vuldb.com
https://vuldb.com/?ctiid.350412
vuldb.com
https://vuldb.com/?id.350412
More from projectsend
9.8
CVE-2024-11680
ProjectSend Unauthenticated Configuration Modification
9.8
CVE-2023-53980
ProjectSend r1605 Remote Code Execution via File Extension Manipulation
9.8
CVE-2021-40887
Projectsend version r1295 is affected by a directory traversal vulnerability
9.8
CVE-2016-10734
ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php
9.8
CVE-2016-10733
ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string