CVE-2026-116008: Missing Authorization in Bottelet DaybydayCRM
Affects Bottelet DaybydayCRMSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| BotteletDaybydayCRM | Affected
| Fixed in– |
GitHub ActionsDaybydayCRMpkg:github/DaybydayCRMOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Until a fix is available, restrict access to the /projects/updateassign/{external_id} endpoint to only trusted users and monitor for suspicious reassignment activity.
Description
DaybydayCRM versions up to 2.2.1 have a missing authorization vulnerability in the ProjectsController::updateAssign() function. This flaw allows any authenticated user, including low-privileged employees, to reassign projects without having the required permission. Attackers can send PATCH or POST requests to the /projects/updateassign/{external_id} endpoint with a chosen user_assigned_id to redirect project ownership and notifications.
Impact
The vulnerability allows unauthorized project reassignment by low-privileged authenticated users. This can lead to unauthorized changes in project ownership and notification redirection, potentially disrupting project workflows and exposing sensitive project information to unintended users. However, the vulnerability requires authentication and does not allow privilege escalation beyond project reassignment.
Summary
CVE-2026-116008 describes a missing authorization vulnerability in Bottelet's DaybydayCRM through version 2.2.1. The vulnerability exists in the ProjectsController::updateAssign() method, which does not properly enforce the can-assign-new-user-to-project permission. As a result, any authenticated user with low privileges can reassign projects by sending crafted PATCH or POST requests to the /projects/updateassign/{external_id} endpoint, specifying a user_assigned_id to change project ownership and associated notifications.
References
- github.com/Bottelet/DaybydayCRM/issues/347 (opens in a new tab)
- github.com/Bottelet/DaybydayCRM/pull/362 (opens in a new tab)
- github.com/Bottelet/DaybydayCRM/commit/20a161e6c3e7ad60ee0430678bcbace593dfd1d8 (opens in a new tab)
- github.com/Bottelet/DaybydayCRM/blob/2.2.1/app/Http/Controllers/ProjectsController.php (opens in a new tab)
- vulncheck.com/advisories/daybydaycrm-through-2.2.1-missing-authorization-via-projectscontroller-updateassign (opens in a new tab)