Vulnerability · Published Oct 24, 2026 · Assigned by VulnCheck

CVE-2026-116008DaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssign

Medium 4.3

In plain English

A medium-severity missing authorization in DaybydayCRM from Bottelet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 90.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission. Low-privileged employees can send PATCH or POST requests to /projects/updateassign/{external_id} with a chosen user_assigned_id to redirect project ownership and notifications.

Affected products (as reported)

Vendor	Product	Versions
Bottelet	DaybydayCRM	0 – through 2.2.1

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/Bottelet/DaybydayCRM/issues/347 issue-tracking
https://github.com/Bottelet/DaybydayCRM/pull/362 patch, issue-tracking
https://github.com/Bottelet/DaybydayCRM/commit/20a161e6c3e7ad60ee0430678bcbace593dfd1d8 patch
https://github.com/Bottelet/DaybydayCRM/blob/2.2.1/app/Http/Controllers/ProjectsController.php#L232-L245 technical-description
VulnCheck Advisory: DaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssign third-party-advisory