Home

Description

ProjeQtor versions 7.0 through 12.4.3 contain a missing authorization vulnerability in the objectDetail.php endpoint that allows authenticated users with guest-level privileges to retrieve sensitive data belonging to other users including password hashes and API keys. Attackers can bypass access controls by directly accessing the endpoint without ownership or role-based validation to extract administrator credentials and perform privilege escalation.

PUBLISHED Reserved 2026-04-20 | Published 2026-04-27 | Updated 2026-04-29 | Assigner VulnCheck




HIGH: 7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

MEDIUM: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Problem types

CWE-862 Missing Authorization

Product status

Default status
unaffected

7.0 (semver)
affected

12.4.4 (semver)
unaffected

Credits

Yassine Damiri finder

Noé Susset finder

References

damiri.fr/en/cves/CVE-2026-41464 technical-description exploit

gryfman.fr/cves/CVE-2026-41464 technical-description exploit

www.projeqtor.com product

www.vulncheck.com/...sing-authorization-via-objectdetail-php

cve.org (CVE-2026-41464)

nvd.nist.gov (CVE-2026-41464)

Download JSON