Missing Authorization in DaybydayCRM Allows Project Reassignment

Executive Summary

CVE-2026-116008 is a missing authorization vulnerability in DaybydayCRM through version 2.2.1. It affects the ProjectsController::updateAssign() function, allowing any authenticated user to reassign projects without the required can-assign-new-user-to-project permission. By sending a PATCH or POST request to /projects/updateassign/{external_id} with a user_assigned_id parameter, an attacker can redirect project ownership and notifications to another user.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP requests to /projects/updateassign/{external_id} endpoints. Look for PATCH or POST requests with user_assigned_id parameters from low-privileged users. Check if projects are being reassigned without proper permission checks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows low-privileged employees or attackers with basic access to reassign projects to other users. This could lead to unauthorized changes in project ownership, misdirected notifications, and potential disruption of project workflows. It undermines proper access control and could facilitate social engineering or insider threats.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and audit trails for sensitive data access and modifications. GDPR requires proper authorization for data processing, while HIPAA mandates role-based access to protected health information. The lack of authorization checks may lead to unauthorized access or changes, potentially resulting in non-compliance and associated penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Update DaybydayCRM to the latest version beyond 2.2.1. Implement strict authorization checks in ProjectsController::updateAssign() to verify can-assign-new-user-to-project permission before allowing reassignments.

Useful 0 Not Useful 0