The function Clients::project in the Tenant Handler component of CodeCanyon Perfex CRM contains an authorization check that can be circumvented by manipulating the ID parameter. By supplying a project ID that does not belong to the requesting tenant, a request can be redirected to a project owned by another tenant, allowing a remote attacker to read or post discussion comments that should be confidential. This vulnerability is characterized by authorization bypass (CWE‑285) and privilege escalation through user ID manipulation (CWE‑639).

CodeCanyon Perfex CRM up to version 3.4.1 is affected. The flaw resides in the Application Controllers/Clients.php file within the Tenant Handler module, specifically the Clients::project method. All installations running a vulnerable version should evaluate the tenant isolation controls in this release.

The CVSS score of 5.3 indicates a medium severity impact. EPSS is not available and the issue is not found in the CISA KEV catalog, but the exploit is publicly available and can be executed from a remote web request. As the attack requires only a crafted HTTP request containing a manipulated ID value, the likelihood of exploitation is significant if the application remains unpatched or misconfigured.