This vulnerability exists in the Clients::project function within the application/controllers/Clients.php file of the Tenant Handler component in Perfex CRM up to version 3.4.1. By manipulating the ID parameter, an attacker can bypass authorization checks remotely, potentially gaining unauthorized access to project information or functionality. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability. The vulnerability is publicly known but no official fix or patch has been disclosed yet.

Successful exploitation allows an attacker to bypass authorization controls remotely, potentially accessing or manipulating project data without proper permissions. The impact is rated medium based on the CVSS score, reflecting limited but non-negligible risk to confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected function or implementing additional access controls at the network or application level to mitigate unauthorized access risks.