| Título | Bottelet DaybydayCRM <= 2.2.1 Insecure Direct Object Reference (IDOR) / Improper Authorization |
|---|
| Descrição | A critical vulnerability was found in Bottelet DaybydayCRM up to version 2.2.1. The issue affects the view and download methods in the app/Http/Controllers/DocumentsController.php file. Due to a lack of ownership and proper authorization checks, any authenticated user can view and download arbitrary documents by simply supplying an external_id (Insecure Direct Object Reference).
Issue: https://github.com/Bottelet/DaybydayCRM/issues/347
Fix Pull Request: https://github.com/Bottelet/DaybydayCRM/pull/362 |
|---|
| Fonte | ⚠️ https://github.com/Bottelet/DaybydayCRM/issues/347 |
|---|
| Utilizador | Mitchell45 (UID 98149) |
|---|
| Submissão | 11/05/2026 11h40 (há 5 meses) |
|---|
| Moderação | 31/05/2026 18h26 (20 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 367575 [Bottelet DaybydayCRM até 2.2.1 DocumentsController.php view Elevação de Privilégios] |
|---|
| Pontos | 20 |
|---|