CVE-2026-116008— DaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssign
Quick assessment
Affected
Bottelet DaybydayCRM
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
DaybydayCRM 2.2.1 及之前版本在 方法中存在缺失授权检查的漏洞，允许任何已认证用户在没有 权限的情况下重新分配项目。低权限员工可通过向 发送包含指定 的 PATCH 或 POST 请求，篡改项目所有权及相关通知的接收人。
Possible ATT&CK Techniques 1 AI
T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-116008
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
DaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssign
Source: CVE Program / CVE List V5
Vulnerability Description
DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission. Low-privileged employees can send PATCH or POST requests to /projects/updateassign/{external_id} with a chosen user_assigned_id to redirect project ownership and notifications.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Bottelet | DaybydayCRM | 0 ~ 2.2.1 | - |
|
II. Public POCs for CVE-2026-116008
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-116008
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-116008 (1)
Vendor Advisories for CVE-2026-116008 (2)
Other References for CVE-2026-116008 (1)
IV. Related Vulnerabilities
Same product: DaybydayCRM
-
CVE-2026-10283
Bottelet DaybydayCRM Setting missing authentication -
CVE-2026-10282
Bottelet DaybydayCRM DocumentsController.php view improper a -
CVE-2022-22113
DayByDay CRM - Insufficient Session Expiration after Passwor -
CVE-2022-22112
DayByDay CRM - Application-Wide Client-Side Template Injecti -
CVE-2022-22111
DayByDay CRM - Missing Authorization when Changing Password
Same vendor: Bottelet
-
CVE-2026-10283
Bottelet DaybydayCRM Setting missing authentication -
CVE-2026-10282
Bottelet DaybydayCRM DocumentsController.php view improper a -
CVE-2022-22113
DayByDay CRM - Insufficient Session Expiration after Passwor -
CVE-2022-22112
DayByDay CRM - Application-Wide Client-Side Template Injecti -
CVE-2022-22111
DayByDay CRM - Missing Authorization when Changing Password
Same weakness: CWE-862
-
CVE-2026-114191
WordPress UPI QR Code Payment Gateway for WooCommerce plugin -
CVE-2026-114192
WordPress WpEvently plugin <= 5.7.8 - Broken Access Control -
CVE-2026-114705
WordPress WP Social Feed Gallery plugin <= 5.0.13 - Broken A -
CVE-2026-110892
WordPress SureDash plugin <= 1.12.2 - Broken Access Control -
CVE-2026-115975
Broken access control in JiraController
V. Comments for CVE-2026-116008
No comments yet