PT-2026-36931

CVE-2026-7782

Published

2026-05-04

Updated

2026-05-05

Description by

CVSS 2.0

6.5

Medium

MetricsAV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CodeCanyon Perfex CRM versions prior to 3.4.2

Description An authorization bypass exists in the Tenant Handler component within the Clients::project() function of the application/controllers/Clients.php file. A remote attacker can exploit this by manipulating the ID argument.

Recommendations Update to version 3.4.2 or later. As a temporary workaround, restrict access to the Clients::project() function until the update is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Jobyer Ahmed

Suffer

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key

CWE-285: Improper Authorization