CVE-2026-116008

Name of the Vulnerable Software and Affected Versions DaybydayCRM versions prior to 2.2.2

Description An authorization flaw exists in the updateAssign() function of the ProjectsController. This issue allows any authenticated user to reassign projects even if they lack the can-assign-new-user-to-project permission. Low-privileged employees can exploit this by sending PATCH or POST requests to the '/projects/updateassign/{external id}' endpoint using a specific user assigned id to redirect project ownership and notifications.

Recommendations Update DaybydayCRM to version 2.2.2 or later. As a temporary mitigation, restrict access to the '/projects/updateassign/{external id}' endpoint for users without administrative privileges.