Threat Intelligence Database

DaybydayCRM versions up to 2.2.1 have a missing authorization vulnerability in the ProjectsController::updateAssign() function. This flaw allows any authenticated user, including low-privileged employees, to reassign projects without having the required permission. Attackers can send PATCH or POST requests to the /projects/updateassign/{external_id} endpoint with a chosen user_assigned_id to redirect project ownership and notifications.

A vulnerability was detected in Bottelet DaybydayCRM up to 2.2.1. Affected is an unknown function of the component Setting Handler. Performing a manipulation results in missing authentication. Remote exploitation of the attack is possible. It is recommended to apply a patch to fix this issue.

CVE-2026-10282 is a medium severity vulnerability in Bottelet DaybydayCRM versions up to 2.2.1. It involves improper authorization in the view function of the DocumentsController.php file. The vulnerability can be exploited remotely without user interaction or privileges. No official patch or remediation guidance is currently confirmed. Users are advised to monitor vendor advisories for updates and apply patches once available.