Vulnerability · Published Sep 29, 2026 · Assigned by VulnCheck

CVE-2026-61519Liberu CRM 0.9.1 < 10.0.0 Broken Access Control via TeamPolicy::addTeamMember()

High 8.8

In plain English

A high-severity incorrect authorization in Liberu CRM from Liberu Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.4%top 67.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability that allows any user holding a pending team invitation to invite additional attacker-controlled accounts with elevated privileges by exploiting a flawed authorization predicate in TeamPolicy::addTeamMember() that grants invitation rights based solely on the existence of a pending invitation email match. Attackers can send a POST request to the team-invitations route specifying the admin role for a second account, bypassing privilege-level validation in InviteTeamMember, causing the second account upon invitation acceptance to be attached to the team with full admin-level create, read, update, and delete access over all team-scoped data.

Affected products (as reported)

Vendor	Product	Versions
Liberu Software	Liberu CRM	0.9.1 – before 10.0.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Researcher Disclosure technical-description
Fixed Release release-notes
Patch Commit patch
https://www.vulncheck.com/advisories/liberu-crm-broken-access-control-via-teampolicy-addteammember third-party-advisory