Description
A vulnerability was detected in CodeCanyon Perfex CRM up to 3.4.1. This affects the function Clients::project of the file application/controllers/Clients.php of the component Tenant Handler. The manipulation of the argument ID results in authorization bypass. The attack may be performed from remote. The exploit is now public and may be used.
Published: 2026-05-04
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The function Clients::project in the Tenant Handler component of CodeCanyon Perfex CRM contains an authorization check that can be circumvented by manipulating the ID parameter. By supplying a project ID that does not belong to the requesting tenant, a request can be redirected to a project owned by another tenant, allowing a remote attacker to read or post discussion comments that should be confidential. This vulnerability is characterized by authorization bypass (CWE‑285) and privilege escalation through user ID manipulation (CWE‑639).

Affected Systems

CodeCanyon Perfex CRM up to version 3.4.1 is affected. The flaw resides in the Application Controllers/Clients.php file within the Tenant Handler module, specifically the Clients::project method. All installations running a vulnerable version should evaluate the tenant isolation controls in this release.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity impact. EPSS is not available and the issue is not found in the CISA KEV catalog, but the exploit is publicly available and can be executed from a remote web request. As the attack requires only a crafted HTTP request containing a manipulated ID value, the likelihood of exploitation is significant if the application remains unpatched or misconfigured.

Generated by OpenCVE AI on May 4, 2026 at 23:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Perfex CRM to a version that includes the vendor fix for the broken access control.
  • If an immediate upgrade is not feasible, modify Clients::project to validate that the supplied project ID belongs to the current tenant and enforce ACL checks before any action is allowed.
  • Reduce the attack surface by disabling the project discussion feature or restricting the corresponding API endpoints to users with explicit permissions until a patch is deployed.

Generated by OpenCVE AI on May 4, 2026 at 23:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 04 May 2026 22:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in CodeCanyon Perfex CRM up to 3.4.1. This affects the function Clients::project of the file application/controllers/Clients.php of the component Tenant Handler. The manipulation of the argument ID results in authorization bypass. The attack may be performed from remote. The exploit is now public and may be used.
Title CodeCanyon Perfex CRM Tenant Clients.php project authorization
Weaknesses CWE-285
CWE-639
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-05-04T22:30:18.897Z

Reserved: 2026-05-04T15:58:24.488Z

Link: CVE-2026-7782

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-05-04T23:16:01.327

Modified: 2026-05-04T23:16:01.327

Link: CVE-2026-7782

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-04T23:30:11Z

Weaknesses