CVE-2024-11680: ProjectSend improper authentication allows unauthenticated config changes

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated remote configuration modification leading to code execution, with a 9.8 CVSS score, KEV listing and public exploit code.

What it is

ProjectSend versions prior to r1720 expose options.php without authentication, letting remote attackers modify application configuration. Because configuration control leads to account creation, webshell upload and stored JavaScript injection, the flaw is a full compromise path rather than a minor misconfiguration.

Impact

An unauthenticated attacker can create accounts, upload webshells and embed malicious JavaScript, gaining code execution and persistent control of the ProjectSend instance.

Attack surface

Reachable over the network via crafted HTTP requests to options.php with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet- or network-exposed ProjectSend instance below r1720 is in scope.

Exploitation

Listed in CISA KEV since 2024-12-03 with a 30-day EPSS probability near 0.917, and public exploit code exists (Metasploit module and Nuclei template), so exploitation is active and widespread.

What to do

• Upgrade ProjectSend to r1720 or later, which contains the patch commit.
• If patching is not immediately possible, restrict network access to the ProjectSend instance and block external requests to options.php.
• Audit existing installations for unauthorized accounts, uploaded files and injected JavaScript before and after patching.
• Rotate credentials and secrets stored in the application configuration, since configuration was writable by unauthenticated users.
• Follow CISA KEV required action: apply vendor mitigations or discontinue use if mitigations are unavailable.

Detection

• Monitor web logs for unauthenticated POST or GET requests to options.php, especially from unexpected source IPs.
• Alert on new account creation, file uploads and changes to application configuration outside normal administrative windows.
• Search for webshell artifacts and unexpected JavaScript in ProjectSend content directories and templates.
• Use the public Nuclei template for ProjectSend authentication bypass to scan exposed instances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.