The vulnerability lies in the authorization logic within TeamPolicy::addTeamMember(), where the existence of a matching pending invitation email grants invitation rights without checking role integrity. An attacker who has a pending invitation can exploit this flaw by sending a crafted POST request, assigning an admin role to a second account. Upon acceptance, the second account obtains full create, read, update, and delete permissions across all team-scoped data. This results in unauthorized data access and modification, effectively granting elevated privileges to the attacker. The weakness corresponds to CWE-863, Broken Access Control.

The flaw is present in Liberu Software’s Liberu CRM versions 0.9.1 and all releases prior to 10.0.0. The affected functionality is the team‑invitations endpoint used by the web application to handle invites.

The CVSS score of 8.7 classifies this as a High‑Severity flaw. EPSS data is not available, but the issue is not listed in CISA’s KEV catalog. The attack vector is a web‑based POST request to the team-invitations route, requiring only a pending invitation; therefore an attacker can exploit the vulnerability with minimal effort once a pending invite is obtainable. The resulting escalation enables full administrative control over all data scoped to the team, which poses a serious confidentiality and integrity threat.