CVE-2026-116008

DaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssign

Published Oct 24, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission. Low-privileged employees can send PATCH or POST requests to /projects/updateassign/{external_id} with a chosen user_assigned_id to redirect project ownership and notifications.

Analysis

Technical impact

The vulnerability in DaybydayCRM enables authenticated users to call the ProjectsController::updateAssign() endpoint and change the project owner without having the required permission, resulting in unauthorized movement of project ownership and associated notifications. This missing authorization flaw is classified as CWE-862, exposing a privilege escalation risk within the application.

Affected Systems

It affects Bottelet DaybydayCRM versions up to and including 2.2.1. Any installation running these releases that exposes the /projects/updateassign API endpoint is susceptible, regardless of role or user type, provided the user is authenticated.

Risk and Exploitability

With a CVSS score of 5.3, the vulnerability is considered Medium severity. The EPSS score is not available, and the flaw is not listed in CISA KEV. Attackers require authentication and can exploit the issue by sending HTTP PATCH or POST requests to /projects/updateassign/{external_id} with a desired user_assigned_id. No additional privileges or network conditions are explicitly required, so the risk is moderate but potentially significant within an organization that trusts authenticated users.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Bottelet

DaybydayCRM

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.2.1

No data.

Vendor Product Versions

Bottelet

Daybydaycrm

Version	Status	Scheme	Platform
`[0,2.2.1]`	affected	generic	—

Daybydaycrm

Daybyday Crm

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Verify whether your DaybydayCRM installation is version 2.2.1 or earlier; if so, plan an upgrade to a version where this bug is fixed.
Restrict the ability to reassign projects by revoking or tightening the permissions that allow modification of project ownership for low‑privileged employees.
As a temporary measure, block or monitor HTTP PATCH/POST traffic directed to /projects/updateassign/* endpoints to detect or prevent unauthorized reassignment attempts.

Generated by OpenCVE AI on October 24, 2026 at 12:24 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.196% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/Bottelet/DaybydayCRM/blob/2.2.1/app/Http/Controllers/ProjectsController.php#L232-L245
https://github.com/Bottelet/DaybydayCRM/commit/20a161e6c3e7ad60ee0430678bcbace593dfd1d8
https://github.com/Bottelet/DaybydayCRM/issues/347
https://github.com/Bottelet/DaybydayCRM/pull/362
https://www.vulncheck.com/advisories/daybydaycrm-through-2.2.1-missing-authorization-via-projectscontroller-updateassign

History

Nov 6, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 24, 2026 1:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Bottelet Bottelet daybydaycrm
Vendors & Products		Bottelet Bottelet daybydaycrm

Oct 24, 2026 11:45 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission. Low-privileged employees can send PATCH or POST requests to /projects/updateassign/{external_id} with a chosen user_assigned_id to redirect project ownership and notifications.
Title		DaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssign
First Time appeared		Daybydaycrm Daybydaycrm daybyday Crm
Weaknesses		CWE-862
CPEs		cpe:2.3:a:daybydaycrm:daybyday_crm::::::::
Vendors & Products		Daybydaycrm Daybydaycrm daybyday Crm
References		https://github.com/Bottelet/DaybydayCRM/blob/2.2.1/app/Http/Controllers/ProjectsController.php#L232-L245 https://github.com/Bottelet/DaybydayCRM/commit/20a161e6c3e7ad60ee0430678bcbace593dfd1d8 https://github.com/Bottelet/DaybydayCRM/issues/347 https://github.com/Bottelet/DaybydayCRM/pull/362 https://www.vulncheck.com/advisories/daybydaycrm-through-2.2.1-missing-authorization-via-projectscontroller-updateassign
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}`