Threat database

Liberu CRM versions from 0.9.1 up to but not including 10.0.0 have a broken access control vulnerability. This flaw allows users with a pending team invitation to escalate privileges by inviting additional accounts with admin rights. The vulnerability arises from improper authorization checks in the TeamPolicy::addTeamMember() function, which grants invitation rights based only on the presence of a matching pending invitation email. Attackers can exploit this by sending a crafted POST request to the team-invitations endpoint, specifying an admin role for a second account. Upon acceptance, the second account gains full administrative access to all team-scoped data.