A known vulnerability exists in Bottelet DaybydayCRM up to version 2.2.1, caused by a flaw in the Setting Handler function. By manipulating a request, an attacker can cause a missing authentication check and thereby bypass the required login process. This flaw results in an Authentication Bypass, allowing remote exploitation without valid credentials, and is classified as CWE‑287 and CWE‑306.

The vulnerability affects Bottelet DaybydayCRM versions up to and including 2.2.1. Any deployment of this product that has not yet been upgraded to a fixed release is susceptible. The flaw resides in the Setting Handler component; the vendor is Bottelet.

The CVSS score of 5.3 indicates a moderate severity, but the absence of an EPSS score leaves the exact exploit probability uncertain. The issue is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been reported. However, remote exploitation is feasible, likely by sending a crafted request to the web interface that triggers the vulnerable function. Attackers would need network access to the application and the ability to manipulate the specific input. Given the missing authentication, there is a credible risk that an unauthorized user could gain privileged access if the vulnerability is exploited.