The Ekushey Project Manager CRM through version 5.0 suffers from a missing uniqueness constraint on the email field for client accounts. Authenticated administrators can exploit this by creating duplicate accounts sharing the same email address but with different passwords. This results in conflicting account states that cause unpredictable authentication outcomes, potentially allowing unauthorized access to client accounts. The vulnerability is classified as high severity with a CVSS 4.0 score of 7.1. There is no vendor advisory or patch information available at this time, and the product is not a cloud service.

The vulnerability allows authenticated administrators to create multiple client accounts with identical email addresses but different passwords, leading to conflicting authentication states. This can cause unpredictable login behavior and may enable unauthorized access to client accounts, undermining account integrity and security. Since the flaw requires administrator privileges to exploit, the risk is elevated within environments where administrator accounts may be compromised or misused.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator account access to trusted personnel only and monitor for suspicious account creation activity involving duplicate emails. Avoid using accounts with duplicated email addresses for sensitive operations.