This vulnerability affects CodeCanyon TimeCamp Integration for CRM up to version 2.8. The flaw exists in the Contact Information Update component, specifically in the handling of the contact_id parameter in the /clients/save_contact endpoint. Manipulation of this parameter enables an attacker to bypass authorization checks remotely. The vulnerability has been assigned CVE-2026-19966 and has a CVSS 4.0 score of 5.3, indicating medium severity. Although exploit code is publicly available, no official fix or vendor advisory has been published to date.

Successful exploitation allows remote attackers with limited privileges to bypass authorization controls, potentially enabling unauthorized access or modification of contact information within the CRM system. This could lead to unauthorized data exposure or manipulation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. In the meantime, restrict access to the affected endpoint and apply compensating controls to limit exposure.