This vulnerability in Bottelet DaybydayCRM (up to version 2.2.1) affects the view function in app/Http/Controllers/DocumentsController.php, leading to improper authorization. The flaw allows remote attackers to potentially access or manipulate data without proper authorization. The CVSS 4.0 base score is 5.3, indicating medium severity, with network attack vector, low complexity, no privileges required, and no user interaction needed. No official patch or vendor advisory detailing remediation is currently available.

Successful exploitation could allow remote attackers to bypass authorization controls in the affected function, potentially leading to unauthorized access to documents or data within the application. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. It is recommended to follow best practices by applying any official patches once released. Until then, consider restricting access to the affected functionality and monitor for updates from Bottelet.