Read the docs
TI-2022-06458 Aliases CVE-2022-22111GHSA-w6rp-4vj7-v2m8

DayByDay CRM - Missing Authorization when Changing Password

Priority MEDIUM 40CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able to change the password of other users, including the administrator’s. This allows the attacker to gain access to the highest privileged user in the application.

Why it matters now

EPSS 0.01029 63rd percentileScored 2026-11-07
Fix Fixed bottelet/flarepoint (Packagist): 2.2.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
BotteletDaybydayCRM2.2.0—No fix listedCNA
Botteletflarepoint2.2.0—No fix listedCNA
—bottelet/flarepoint (Packagist)before 2.2.12.2.1Patch availableGHSA-w6rp-4vj7-v2m8
  • DaybydayCRM VendorBottelet Affected 2.2.0 Fixed in — No fix listed CNA
  • flarepoint VendorBottelet Affected 2.2.0 Fixed in — No fix listed CNA
  • bottelet/flarepoint (Packagist) Vendor— Affected before 2.2.1 Fixed in 2.2.1 Patch available GHSA-w6rp-4vj7-v2m8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:daybydaycrm:daybyday_crm:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableBottelet
  • cpe:2.3:a:daybydaycrm:daybyday_crm:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Bottelet

Remediation

  • Fix · GHSA-w6rp-4vj7-v2m8 bottelet/flarepoint (Packagist) Fixed in 2.2.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-22111
  2. 2026-10-03 Alias added: GHSA-w6rp-4vj7-v2m8

References

Patch 1

Advisory 2

Other 1

  • TI-2022-06457 DayByDay CRM - Weak Password Requirements in Update User CVSS 3.1HIGH 7.5
  • TI-2022-06456 DayByDay CRM - Stored Cross-Site Scripting (XSS) in Task Title CVSS 3.1MEDIUM 5.4
  • TI-2022-06455 DayByDay CRM - Missing Authorization when Viewing Absences CVSS 3.1MEDIUM 4.3
  • TI-2022-06454 DayByDay CRM - Missing Authorization when Viewing Appointments CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences