Read the docs
TI-2026-44092 Aliases CVE-2026-61519GHSA-2xh3-6r9v-rqmp

Liberu CRM 0.9.1 < 10.0.0 Broken Access Control via TeamPolicy::addTeamMember()

Priority MEDIUM 40CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability that allows any user holding a pending team invitation to invite additional attacker-controlled accounts with elevated privileges by exploiting a flawed authorization predicate in TeamPolicy::addTeamMember() that grants invitation rights based solely on the existence of a pending invitation email match. Attackers can send a POST request to the team-invitations route specifying the admin role for a second account, bypassing privilege-level validation in InviteTeamMember, causing the second account upon invitation acceptance to be attached to the team with full admin-level create, read, update, and delete access over all team-scoped data.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00379 32nd percentileScored 2026-11-07
Fix Fixed Liberu CRM (Liberu Software): 10.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Liberu SoftwareLiberu CRM0.9.1 to before 10.0.010.0.0Patch availableCNA
  • Liberu CRM VendorLiberu Software Affected 0.9.1 to before 10.0.0 Fixed in 10.0.0 Patch available CNA

Remediation

  • Fix · CNA Liberu CRM (Liberu Software) Fixed in 10.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-61519
  2. 2026-10-03 Alias added: GHSA-2xh3-6r9v-rqmp

References

Patch 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences