| शीर्षक | Bottelet DaybydayCRM <= 2.2.1 Improper Authorization |
|---|
| विवरण | A vulnerability was found in Bottelet DaybydayCRM up to version 2.2.1. It has been rated as medium to high severity. The issue affects the updateAssign methods in multiple controllers, specifically TasksController, ProjectsController, and LeadsController. These methods lack the required permission checks (e.g., can() checks), which allows unauthorized authenticated users to inappropriately modify resource assignments across the application. The vulnerability was patched in Pull Request #362 by enforcing proper assignment permission checks matching their respective sibling updateStatus methods. |
|---|
| स्रोत | ⚠️ https://github.com/Bottelet/DaybydayCRM/issues/347 |
|---|
| उपयोगकर्ता | Mitchell45 (UID 98149) |
|---|
| सबमिशन | 11/05/2026 11:42 AM (5 महीनों पहले) |
|---|
| संयम | 31/05/2026 06:26 PM (20 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 367575 [Bottelet DaybydayCRM तक 2.2.1 DocumentsController.php view अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|