ProjectSend EUVD-2026-109388

Requires an authenticated staff account (PR:L) with file upload/edit capability in ProjectSend; anonymous or pure-client access is not sufficient. Exploitation is further gated (AT:P) by pre-existing state the attacker does not fully control: either a multi-level version chain where the linked $previous is itself a revision so its root is a separate protected file, or a situation where someone else has already shared the attacker's upload with a client outside the attacker's authorized roster. The flaw is reached through the file version linking endpoints (web route files.version.store or PUT /api/v1/files/{id}/version with previous_file_id). Limiting factors: the attacker must be a trusted client-scoped staff member, the abuse only widens exposure to recipients/roots that the required preconditions make available, and the patched versions add authorization checks that refuse the link entirely. The default-configuration, remote-unauthenticated case does not apply.

This is a genuine but moderate-priority issue, not a drop-everything emergency. The only severity data supplied is a CVSS 4.0 base score of 6.0 (MEDIUM); no CVSS 3.1 vector, no EPSS score, and no SSVC decision breakdown were provided, so exploitation-probability modeling is unavailable. The 4.0 vector tells a consistent story: AV:N (reachable over the network via the web UI or /api/v1 endpoint) and UI:N, but PR:L means the attacker must already hold a staff account, and AT:P means success depends on specific preconditions (an existing multi-level version chain, or a file already shared with an out-of-scope client by someone else). Impact is weighted to confidentiality (VC:H - protected original files exposed to unauthorized clients) with only low integrity (VI:L) and no availability impact; SC/SI/SA:N indicate no scope change to other systems. It is NOT in CISA KEV, there is no EPSS signal, and the input shows no PoC or exploit reference - exploitation status is 'no public exploit identified at time of analysis.' The vuln.today priority is 'this_month,' which aligns with the picture: a real authorization-boundary flaw that requires a trusted insider (client-scoped staff) and pre-existing conditions, so it favors targeted misuse by an authorized-but-limited user rather than widespread opportunistic attack. Missing EPSS/KEV data should be treated as absence of a widespread-exploitation signal, not as confirmation of low risk.

A client-scoped staff member in ProjectSend (who may only share files with their own assigned clients) uses the file-version linking feature to link one of their own files onto an intermediate revision whose root is a third, protected file, or to carry an out-of-scope client recipient onto that root. Because moveAssignmentsToRoot() reassigns recipients to the chain's root without re-authorizing them, a protected original file belonging to another scope becomes visible to clients the attacker was never allowed to share with. No public exploit is identified at the time of analysis, though the vendor patch commit and VulnCheck advisory describe the mechanism in detail.