A flaw exists in the view function of the DocumentsController within Bottelet DaybydayCRM up to version 2.2.1 that allows an attacker to bypass the intended authorization checks. The improper authorization can enable viewing of documents that a legitimate user should not have access to, potentially exposing sensitive business documents or private customer information. The weakness is a classic example of inadequate permission enforcement, corresponding to the CWE identifiers related to privilege escalation and authentication failures.

The vulnerability affects all installations of Bottelet DaybydayCRM versions up to and including 2.2.1. Users who rely on the default role‑based access controls for document management are impacted, as the code controlling access in app/Http/Controllers/DocumentsController.php fails to confirm the caller’s permissions before returning the document data.

The CVSS score of 5.3 indicates a moderate severity, and the vulnerability is exploitable via a remote attack vector, as indicated by the description. While the EPSS score is not available, the existence of this flaw and its remote nature mean that a motivated adversary could discover and exploit it without special pre‑conditions. It is not currently listed in the CISA KEV catalog, but administrators should still consider it a risk due to the potential for unauthorized data exposure.