This vulnerability exists in the Clients::project function of the application/controllers/Clients.php file in Perfex CRM up to version 3.4.1. By manipulating the ID parameter, an attacker can bypass authorization checks, potentially gaining unauthorized access to project data. The vulnerability is remotely exploitable without user interaction and requires low attack complexity and privileges. The CVSS 4.0 vector indicates network attack vector, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability.

An attacker can bypass authorization controls in the affected versions of Perfex CRM, potentially accessing or interacting with project data they should not have permission to access. The impact is limited to the scope of the Clients::project function and the Tenant Handler component. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected functionality or implementing additional access controls as a temporary measure.