CVE-2026-4045

CVE-2026-4045 identifies a low-severity flaw in ProjectSend versions up to r1945, specifically within the `includes/Classes/Auth.php` file. This vulnerability allows a remote attacker to achieve an observable response discrepancy by manipulating the `ldap_email` argument. With a CVSS score of 3.7 LOW, the potential impact is limited to low confidentiality, and exploitation is considered difficult due to high attack complexity. Although an exploit has reportedly been published, there is no evidence of active exploitation, public exploit tools, or community discussion surrounding this CVE. The vendor did not respond to the initial disclosure.