CVE-2024-11680 ProjectSend Improper Authentication

Exploited in the wild Critical 9.8 Published 26 Nov 2024 Updated 14 Jul 2026

Unauthenticated attackers can modify ProjectSend configuration to create accounts, upload webshells, and inject malicious JavaScript.

Exploited in the wild: Since 3 Dec 2024
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-11680?

CVE-2024-11680 is a critical missing authorization vulnerability in ProjectSend, published on 26 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

Weakness: CWE-306

Which versions are affected by CVE-2024-11680?

It affects 1 product.

Products include Projectsend Projectsend.

How do I fix CVE-2024-11680?

No fix has been published for CVE-2024-11680 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 24 Dec 2024.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-11680 being exploited?

Yes. Attackers have exploited CVE-2024-11680 in the wild since at least 3 Dec 2024.

Public exploit code: 1 Metasploit module, 1 Nuclei template and 1 proofs of concept on GitHub.

Sources

Also known as GHSA-755x-386x-p26p.