CVE-2026-7144CWE-285CWE-639

1000 Projects Portfolio Management System MCA update_passwd_process.php authorization

Medium · published April 27, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
29.3
In the wild
Unconfirmed
What it is

A security flaw has been discovered in 1000 Projects Portfolio Management System MCA 1.0. This impacts an unknown function of the file update_passwd_process.php. The manipulation of the argument temp_user results in authorization bypass. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00367 · 29.3th percentile
Weaknesses
CWE-285 · Improper Authorization; CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-04-27T17:30Z
EPSS history
Timeline
  • 27 APR 17:30Z
    1000 Projects Portfolio Management System MCA update_passwd_process.php authorization
    cvelistv5