EIP-2026-111542

This advisory details an Insecure Direct Object Reference (IDOR) and authentication bypass vulnerability in ProjectSend r754, allowing attackers to access other clients' private files by manipulating the 'client' and 'file' parameters in the 'process.php?do=zip_download' endpoint.