Ekushey Project Manager CRM version 5.0 allows an authenticated administrator to create multiple client accounts that share the same email address but have different passwords. The absence of a uniqueness constraint on the email field lets attackers create conflicting states where a user may be able to log in with an unintended password, potentially allowing unauthorized access to client data or services. This flaw represents a CWE-303 weakness, indicating improper validation of constraints in data management. This flaw can also lead to account fuzziness, making it hard to ascertain which account is legitimate and may result in erratic system behavior during authentication and authorization procedures.

Ekushey Project Manager CRM distributed by Creativeitem, version 5.0, is affected. This publicly available CRM is delivered through the specified version and any identical releases lacking the missing constraint are also susceptible. The vulnerability is tied to the user management component that stores client information in the underlying database.

The CVSS score of 7.1 indicates moderate‑to‑high severity. The EPSS score indicates a very low probability of exploitation (<1%). The vulnerability is not listed in CISA's KEV catalog. Attackers must first obtain administrative credentials to exploit the flaw. After authenticating, they can create duplicate client accounts with the same email, thereby creating a situation where the authentication process may endorse the wrong credentials. Since the flaw resides in data consistency, the exploitation does not require a separate code execution step but rather administrative access to create records. An attacker with sufficient privileges can achieve unauthorized access to client information and potentially disrupt account management functions.