Read the docs
TI-2026-80077 Aliases CVE-2026-116008GHSA-cx4x-jmw3-mhpf

Missing authorization in DaybydayCRM lets any user reassign projects

Priority LOW 23CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

DaybydayCRM by Bottelet through 2.2.1 contains a missing authorization check (CWE-862) in ProjectsController::updateAssign(). Any authenticated user, including low-privileged employees, can reassign projects without the can-assign-new-user-to-project permission, which redirects project ownership and notifications to a chosen user.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission. Low-privileged employees can send PATCH or POST requests to /projects/updateassign/{external_id} with a chosen user_assigned_id to redirect project ownership and notifications.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00196 9th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BotteletDaybydayCRMup to 2.2.1—No fix listedCNA
  • DaybydayCRM VendorBottelet Affected up to 2.2.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for DaybydayCRM.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-24 Threatist record created from CVE-2026-116008
  2. 2026-10-24 Alias added: GHSA-cx4x-jmw3-mhpf
  3. 2026-11-05 CISA SSVC decision points changed

References

Patch 2

Other 2

  • TI-2022-06460 DayByDay CRM - Insufficient Session Expiration after Password Change CVSS 3.1HIGH 8.8
  • TI-2022-06458 DayByDay CRM - Missing Authorization when Changing Password CVSS 3.1HIGH 8.8
  • TI-2022-06457 DayByDay CRM - Weak Password Requirements in Update User CVSS 3.1HIGH 7.5
  • TI-2022-06459 DayByDay CRM - Application-Wide Client-Side Template Injection (CSTI) CVSS 3.1MEDIUM 5.4
  • TI-2022-06456 DayByDay CRM - Stored Cross-Site Scripting (XSS) in Task Title CVSS 3.1MEDIUM 5.4
  • TI-2020-18167 Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen. CVSS 3.1MEDIUM 5.4
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences