CVE-2026-116008

MediumCVSS 4.3/10Last modified Oct 24, 2026

Description

DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission. Low-privileged employees can send PATCH or POST requests to /projects/updateassign/{external_id} with a chosen user_assigned_id to redirect project ownership and notifications.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
BotteletDaybydayCRM<= 2.2.1

References

Timeline

Published
Oct 24, 2026
Last modified
Oct 24, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-1160098.8Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files CVE-2026-116015.3The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all CVE-2026-1160104.3RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outCVE-2026-1160117.5Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to craCVE-2026-1160123.6Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that CVE-2026-1160133.7OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to CVE-2026-1160148.1open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for CVE-2026-1160154.3yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated meCVE-2026-1160167.1yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope resCVE-2026-1160174.3Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBCVE-2026-1160184.3ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to markCVE-2026-1160198.8Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by r