PT-2026-122589
CVE-2026-116008
·
Published
2026-10-24
·
Updated
2026-10-24
Description by
CVSS 3.1
4.3
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission. Low-privileged employees can send PATCH or POST requests to /projects/updateassign/{external id} with a chosen user assigned id to redirect project ownership and notifications.
Found an issue in the description? Have something to add? Feel free to write us 👾